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ABSTRACT 


Several  methodologies  relevant  to  the  development  of  a 
safety  program  for  the  Korean  Air  Force  were  reviewed. 
Methodologies  considered  included; 

1)  Control  charts 

2)  System  safety  analysis 

3)  Critical  incident  technique. 

Data  collection  methods  applicable  to  accident  analysis 
were  proposed. 

Recommendations  for  the  incorporation  of  these  methods 
into  a  safety  program  for  the  K.A.F.  were  developed. 

The  safety  program  described  in  the  current  thesis 
possesses  the  potential  for  reducing  overall  operational 
costs  and  maximizing  aircraft  availability.   The  end  result 
of  such  a  program  can  only  serve  to  increase  operational 
readiness  and  thereby  maximize  overall  efficiency  and 
military  capability  of  the  K.A.F. 
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I.   INTRODUCTION 

Safety  is  generally  recognized  as  an  essential  part  in 
overall  system  operation.   According  to  Lawrence  (1976)  safety 
can  be  defined  as  a  judgment  of  the  acceptability  of  risk. 
"Safety  is  the  minimization  of  injury  and  loss  resulting  from 
nondeliberate  acts  such  as  accidents  and  natural  calamities" 
(National  Safety  Council,  1973)  . 

A  function  is  safe  if  its  risks  are  judged  to  be  acceptable 
This  definition  emphasizes  the  relativity  and  judgmental 
nature  of  the  concept  of  safety.   It  also  implies  that  two 
very  different  activities  are  required  for  determining  how 
safe  things  are : 

a.  Measuring  risk,  an  objective  but  probabilistic  pursuit. 

b.  Judging  the  acceptability  of  that  risk  (juding  safety) , 
a  matter  of  personal,  social  and  economic  value  judgment. 

System  safety  is  required  to  prevent  injury  and  damage 
in  system  design.   Hammer  (1972)  in  his  Handbook  of  System 
and  Product  Safety  suggests  that  injury  or  damage  can  result 
from  four  fundamental  causes  or  combinations  thereof: 

a.  material  failure. 

b.  human  error. 

c.  adverse  characteristics  of  a  product. 

d.  unusual  environmental  conditions. 

Recently,  personnel  concerned  with  accident  prevention 
have  become  more  convinced  that  injury  or  damage  from  any 


of  those  causes  can  be  prevented  or  lessened  through  good 
design  and  planning  (Figures  1  and  2) .   Figure  1  suggests 
a  model  of  the  material  failure /malfunction  accident.   The 
approach  to  the  investigation,  analysis,  and  prevention  of 
mishaps  caused  by  material  failure/malfunction  is  FIRE 
(material  failure/malfunction,  system  inadequacy,  and  remedial 
measure).   They  are  defined  as  follows: 

a.  A  material  failure /malfunction  (F)  is  a  component  or 
system  that  1)  ceases  to  operate  entirely,  2)  operates, 
but  not  as  designed  or  intended,  3)  operates  as  de- 
signed, however,  operational  needs  require  enhanced 
performance.   A  material  failure/malfunction  is  con- 
sidered for  analysis  only  when  it  is  judged  to  have 
caused  or  contributed  to  the  mishap,  not  resulted 
from  the  mishap. 

b.  A  system  inadequacy  (I)  is  an  element  of  the  aviation 
system  that  did  not  operate  as  intended  or  designed. 
An  I  is  assigned  only  when  it  is  judged  to  have 
caused,  allowed,  or  contributed  to  the  occurrence 

of  an  F.   More  than  one  I  may  be  assigned  to  a  given 
F. 

c.  A  remedial  measure  (RE)  is  an  action  required  to  correct 
or  at  least  reduce  the  operational  impact  of  an  I .   The 
RE  may  be  directed  at  any  command  level  for  implan- 
tation and  is  not  to  be  restricted  by  current  tech- 
nology or  budgetary,  personnel,  and  equipment  resources. 
More  than  one  RE  may  be  recommended  for  a  given  I . 

Figure  2  presents  a  functional  model  of  U.S.  Army's  Air- 
craft Accident  to  the  pilot  error  accident  among  human  errors. 
Items  1  through  8  are  the  basic  elements  of  the  aviation  sys- 
tem.  When  one  or  more  of  these  elements  is  out  of  tolerance, 
an  overload  (Item  9)  is  placed  on  the  pilot's  system  role 
(Item  10)  in  that  he  must  continue  to  perform  his  normal  tasks 
while  correcting  or  adjusting  for  the  abnormal  system  condi- 
tion.  When  this  exceeds  the  pilot's  ability  to  cope  with  it 
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Figure  1.   Model  of  Mishap  Caused  by  Material  Failure/ 
Malfunction  (G.  Dwight  Lindsey  and  William 
R.  Brown  [1979],  Appendix  F-3) 


11 


1 


SELECTION 

AND 
TRAINING 


2 

VEHICLE/ 

EQUIPMENT 

DESIGN 


T 


TRANSITORY 

PSYCHOLOGICAL 

STATES 


SY3TEM 
IMPOSED  OVERLOAD 


10 

PILOT'S  ROLE 
IN  THE  SYSTEM 


ERRORS  PILOT  COULD  NOT 
OR  DID  NOT  CORRECT 


ENVIRONMENT 


SUPERVISION 


TRANSITORY 
PHYSIOLOGICAL 
i STATES 


Figure  2.   Model  of  Accident  Involving  Pilot  Error 
(Ricketson,  1974) 


or  occurs  at  a  critical  time,  he  makes  errors  (Item  11)  in 
his  normal  tasks  and/or  in  handling  the  abnormal  condition. 
Most  of  these  errors  slip  by  without  causing  an  accident 
(Item  12) .   But,  when  events  or  circumstances  operate  un- 
favorably, the  error  leads  to  an  accident  (Item  13). 

This  approach  views  pilot  error  accidents  as  the  result 
of  the  pilot's  system  role  being  overloaded  by  inadequacies 
of  the  pilot,  other  systems  elements,  or  both.   Accidents 
describe  a  point  in  time  to  look  for  system  inadequacies . 
This  model  exemplifies  an  attempt  to  approach  accident  causes 
from  a  "systems"  standpoint.   Research  has  indicated  that 
human  error,  unlike  hardware  difficiency,  is  rarely  the  sole 
factor  in  an  accident.   The  applicability  of  this  functional 
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model  is  not  limited  to  pilot  error  accidents.   It  is  a  model 
that  may  be  used  in  any  evaluation  of  a  man-machine  system. 

The  most  commonly  designated  cause  of  accidents  is  human 
error.   In  the  past  decade,  more  than  70%  of  Korean  Air  Force 
aircraft  accidents  have  been  attributed  to  human  error 
(Aircraft  Accident  Data  of  Korean  Air  Force,  1980).   In  acci- 
dents where  material  failure  is  recognized,  it  is  often  quite 
possible  to  continue  tearing  down  the  equipment  until  the  pre- 
cise portion  that  failed  is  isolated  and  the  cause  of  the 
failure,  whether  it  be  corrosion,  stress,  faulty  load  con- 
ceptualization, or  other  factors,  can  be  determined  and  rede- 
sign proposed.   In  case  of  human  error,  however,  the  static 
statement  that  a  human  being  failed  provides  no  guidance  to 
future  improvement.   The  need  to  reduce  human  error  to  its 
basic  constituents  as  a  means  of  obtaining  insight  into  the 
causes  of  these  failures  has  resulted  in  various  approaches 
to  segmenting  human  behavior  for  analytical  purposes. 

According  to  Florio  and  Stafford  (19  69) ,  when  the  primary 
factor  of  an  accident  is  attributed  to  human  error  the  acci- 
dent cause  may  be  classified  into  five  general  areas: 

a.  Inadequate  knowledge. 

b.  Insufficient  skills. 

c.  Environmental  hazards. 

d.  Improper  habits  and  attitudes. 

e.  Unsafe  behavior. 

Each  of  these  areas  are  discussed  below: 
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Inadequate  knowledge .   Knowledge  is  the  foundation  for 
understanding  and  the  spring-board  for  the  development  of 
desirable  attitudes  toward  safe  behavior.   Ideally  every 
individual  should  learn  and  appreciate  safety  rules.   Ade- 
quate knowledge  is  vital  if  a  person  is  to  avoid  hazardous 
situations  and  react  properly  in  such  a  situation.   Also, 
proper  knowledge  enables  the  individual  to  recognize  and 
evaluate  dangerous  situations  (i.e.,  be  aware  of  tolernace 
limits  of  the  system) . 

Insufficient  skill.   Attempting  to  perform  tasks  beyond 
one's  ability  level  creates  high-risk  situations;  thus  skill 
level  is  an  important  determinant  in  accident  prevention. 
Skills  are  affected  by  many  things,  such  as  strength,  fatigue, 
attitudes,  emotion,  alcohol,  vision,  and  others. 

Environmental  hazards.   It  is  unrealistic  to  think  that  we 
can  create  a  perfectly  safe  environment.   Despite  our  ina- 
bility to  control  our  environment  completely,  only  a  small 
percentage  of  accidents  are  strictly  attributed  to  environ- 
mental factors.   Good  engineering  practices  with  good  design 
reduce  the  environmental  problems. 

Improper  habits  and  attitudes.   Every  worker  should  thoroughly 
understand  the  development  of  attitudes  and  their  possible 
modifications . 

Unsafe  behavior.   Unsafe  behavior  is  the  end  result  of  man's 
failure  to  develop  proper  habits,  attitudes,  and  knowledge 
concerning  safety.   Safe  behavior  entails  responding  correctly 


14 


under  all  circumstances,  and  avoiding,  when  possible,  high- 
risk  situations.   There  is  no  excuse  for  purposely  engaing  in 
unsafe  behavior. 

Accidents  are  the  result  of  many  proximate  and  casual  fac- 
tors.  These  factors,  or  variables,  interact  to  creat  unsafe 
acts  and  unsafe  conditions,  or  both,  which  can  terminate  in 
an  accident  causing  injury,  death,  or  property  damage.   An 
unsafe  act  or  condition  alone,  or  in  some  combination,  if 
occurring  at  the  right  time  may  create  an  accident. 

It  is  axiomatic  that  effective  prevention  must  have  a 
focal  point  of  application.   This  implies  that  the  probable 
cause  of  future  accidents  can  be  predicted.   This,  in  turn, 
implies  that  the  causes  of  past  accidents  have  been  determined, 

The  cost  of  accidents  is  high.   In  the  past  decade  from 
1970,  the  cost  of  aircraft  accidents  in  the  Korean  Air  Force 
approaches  $50  million  (not  including  piloes) [Aircraft 
Accident  Data  of  Korean  Air  Force,  1980] .   As  a  country  that 
has  small  numbers  of  aircraft,  this  represents  a  tremendous 
cost.   In  the  case  of  the  U.S.  Navy /Marines ,  the  total  acci- 
dent cost  (Figure  3)  is  greater  than  the  K.A.F.   For  ulti- 
mate efficiency  with  maximum  operational  readiness  and  minimum 
cost,  more  detailed  accident  prevention  programs  must  be 
followed.   Accident  prevention  is  best  pursued  within  the 
framework  of  a  systematic  program  (Figures  4,  5,  6). 

Figure  4  represents  a  model  of  the  factors  that  may  be 
involved  in  carrying  out  a  system  safety  program.   Minor 
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LEVEL  Of  SAFETY  PCnFOAMANCS 


OPTIMUM  LEVEL 


Figure  5.   An  Optimal  Level  of  Safety  Performance 

(Industrial  Engineering^  Jan.  197  6,  p.  20) 
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Figure  6.   Safety  Improvement  Flow  Chart 
(Industrial  Engineering^  March 
1974,  p.  9) 
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differences  will  exist  in  actual  practice  because  of  the 
different  organizational  structures.  However,  the  model 
indicates  broadly  the  process  that  takes  place. 

A  safety  program,  regardless  of  its  characteristics  or 
goal,  does  cost  money  and  require  time.   It  is  generally 
accepted  that  as  the  level  of  safety  performance  increases, 
the  better  will  be  the  chances  for  reducing  hazards,  and 
consequently,  the  frequency  as  well  as  severity  of  accidents. 
Beyond  a  certain  performance  level,  however,  the  expected 
reduction  in  hazards  starts  to  taper  off  and  will  not  be  of 
appreciative  magnitude  to  offset  the  cost  associated  with 
high  levels  of  safety  activities.   This  is  explained  well 
in  Figure  5. 

Figure  6  as  presented  in  the  overall  safety  improvement 
effort  through  the  accidents  reduction  approach,  includes  the 
following  basic  steps. 

a.  Field  data  assembly. 

In  this  step  operating  data  are  gathered  on  the  system 
to  be  analyzed  to:   acquaint  the  analyst  with  system  opera- 
ting methods,  procedures  and  equipment;  and  obtain  operating 
data  in  the  form  of  methods  and  time  data  for  system  operations. 
In  addition,  accident  data  are  gathered  to  provide  a  basis 
for  identifying  accident  problem  areas  and  determining  poten- 
tial accident  cost  savings. 

b.  System  definition. 

Flow  charting.   Functional  flow  charts  should  be  developed 
to  define  the  system.   The  charts  serve  as  a  guide  for  project 
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members,  put  them  on  the  same  level  of  thinking,  and  allow 
standard  methods  and  procedure  references  that  all  understand. 

The  charts  should  have  a  numbering  system  by  function 
to  permit  coding  of  accident  data.   The  codes  allow  quick 
reference  to  what  work  function  was  being  performed  when  an 
accident  occurred,  and  are  a  means  for  computerized  accident 
information  storage  and  retrieval. 

Accident  data.   All  accident  data  gathered  are  defined/ 
coded  by  work  function  and  hazards  or  causes  assigned  to 
accidents .   Hazards  definition  is  needed  to  indicate  equip- 
ment and  system  shortcomings  with  regard  to  safety. 

c.  Identifying  problem  areas. 

Once  hazards  and  safe  data  have  been  gathered,  they 
must  then  be  examined  for  safety  problem  areas.   The  problem 
areas  should  be  defined  so  that  concepts  may  be  readily 
developed. 

d.  Concept  development. 

Once  safety  problems  have  been  defined,  the  next  step 
is  to  develop  concepts  that  will  eliminate  or  protect  against 
hazards  and,  as  a  result,  reduce  accidents. 

e.  Safety  evaluation. 

The  effects  on  safety  are  determined  by  using  the  hazards 
exposure  data  and  estimating  the  reduction  in  hazards  exposure 
for  all  functions  attributable  to  a  new  concept.   The  hazards 
exposure  reduction  is  an  engineering  estimate  made  by  com- 
paring current  machines/systems  with  those  proposed,  and 
noting  by  work  function  where  hazards  exposures  have  been 
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increased  or  decreased  and  by  how  much.   The  reduction  ex- 
pected in  accidents  is  proportional  to  the  reduction  in  the 
hazard  exposure. 

f.   Recommendations. 

The  last  step  is  to  consider  evaluation  results  for  con- 
cepts and  alternatives  and  make  a  decision  for  further  study, 
or  choose  the  most  attractive  alternatives  for  design 
development. 

There  are  certain  fundamental  concepts  and  methods  that, 
if  properly  applied,  can  increase  the  probability  of  success. 
Accident  prevention  is  a  composite  of  many  related  functions, 
each  of  which  must  be  given  proper  weight  to  assure  a  balanced 
and  productive  program.   It  may  be  considered  a  closed-loop 
system  (Figure  7)  comprising  many  feedback  loops  in  which 
information  is  collected  by  the  responsible  agency,  is  appro- 
priately processed,  is  systematically  analyzed,  and  then  is 
disseminated  to  those  in  a  position  to  make  use  of  the  infor- 
mation.  The  results  of  this  dissemination  are  reevaluated  in 
the  light  of  future  accidents. 

To  put  safety  in  its  proper  perspective,  it  must  be  first 
realized  that  safety  and  efficiency  are  products  of  each 
other.   That  is,  the  safe  establishment  is  efficient.   With 
this  in  mind,  safety  then  becomes  a  management  problem  and 
not  just  the  concern  of  the  foreman  or  the  supervisor. 

Petersen  (1978)  suggests  five  basic  principles  of  a  safety 
management  program.   These  are: 
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RECOmENDATIONS 


DISSEMINATE 


ANALYZE 


PREACCIDENT  PLAN 


ACCIDENT 


INVESTIGATE 


REPORT 


CLOSED  LOOP  FEEDBACK  SYSTEM 


Figure  7.   Organizational  Approach  to  Safety 
(Zeller,  1978) 


a.  An  unsafe  act,  an  unsafe  condition,  and  an  accident 
are  all  symptoms  of  failure  in  the  management  system. 

b.  Certain  circumstances  are  predictive  of  severity  of 
accidents. 

c.  Safety  should  be  managed  like  any  other  operational 
function . 

d.  An  effective  safety  program  will  provide  establishment 
of  responsibility  and  accountability. 

e.  The  function  of  safety  is  to  locate  and  define  the 
operational  errors  that  allow  accidents  to  occur. 
This  function  can  be  carried  out  in  two  ways:   1)  by 
asking  why  accidents  happen — searching  for  their  root 
causes — and  2)  by  asking  whether  certain  known  effec- 
tive controls  are  being  utilized. 
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Now  comes  the  problem  of  safety  measurement.   W.  Tarrants 
(1979)  discussed  this  problem  as  the  problem  that  has  existed 
since  the  very  beginning  of  organized  attempts  to  control 
accidents  and  their  consequences.   In  its  most  elementary 
form,  measurement  has  been  defined  as  "the  process  of  assign- 
ing numerals  to  objects  according  to  rules"  (Stevens,  1951). 
When  we  apply  this  definition  in  the  safety  field,  we  are 
quickly  confronted  with  problems  concerning  what  "objects"  to 
measure  and  what  "rules"  to  follow. 

The  progress  and  maturity  of  a  science  or  technology  are 
often  judged  by  whatever  success  has  been  achieved  in  the  use 
of  measures.   Measurement,  perhaps  more  than  any  other  single 
aspect,  has  been  the  principle  stimulus  of  progress  in  all 
professional  fields.   Measurement  is  the  backbone  of  any 
scientific  approach  to  problem  definition  and  solution.   With- 
out adequate  measurement  in  the  safety  field  we  can  not  des- 
cribe the  safety  state  of  our  operations  or  determine  whether 
or  not  our  safety  programs  are  really  accomplishing  anything. 
Sound  measurement  is  an  absolute  prerequisite  for  control  and 
both  are  necessary  for  prediction. 

The  present  thesis  effort  will  1)  perform  a  literature 
survey  of  the  techniques  to  measure  safety  which  are  applica- 
ble to  measurement  of  flight  safety,  2)  emphasize  the  importance 
of  accident  data  collection  for  analyzing  them,  3)  refer  to 
K.A.F.  accident  data  currently  collected  whether  they  are 
applicable  or  not  to  measure  flight  safety,  and  finally 
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4)  suggest  methodology  to  collect  data  for  applying  each 
technique . 
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II.   LITERATURE  SURVEY 

It  has  become  apparent  that  there  are  many  problems  asso- 
ciated with  defining  a  universal  criterion  for  safety  measure- 
ment and  assessment.   One  of  the  chief  concerns  with  the 
conventional  standards  is  the  emphasis  on  accident  data. 
Many  now  recognize  that  this  is  more  a  reaction  to  existing 
problems  than  action  toward  prevention  or  control  of  future 
problems.   Although  experience  can  be  a  valuable  teacher, 
accident  experience  points  to  needless  loss,  and  too  often 
doesn't  give  sufficient  information  for  prevention. 

Personal  values  present  another  problem  in  safety  measure- 
ment and  assessment.   Safety  attitudes  are  strongly  dependent 
on  the  personal  values  of  workers,  line  management,  and 
corporate  management;  effective  safety  measurement  techniques 
must  be  capable  of  addressing  this  behavioral  aspect. 

Applying  statistical  methods  to  the  population  of  events 
related  to  accidents  is  another  problem  area.   Predictions 
based  on  statistical  analyses  of  accident  data  have  been 
described  as  unreliable  due  to  the  combination  of  variables, 
rare  events  and  small  sample  sizes.   Often,  attempts  are 
made  to  by-pass  this  obstacle  by  combining  nonsimilar  events 
into  a  larger  population  universe. 

Among  the  methods  used  for  safety  measurement  are  included 
statistical  quality  control  techniques,  system  safety  analysis 
techniques,  critical  incident  technique,  learning  curve. 


26 


frequency  and  severity  rate,  safety  sampling,  double  average 
comparison  technique.   Here  the  author  will  describe  the 
methods  which  are  applicable  to  flight  safety  measurement. 

A.   CONTROL  CHARTS 

Greenberg  (1971)  suggests  that  the  techniques  of  statis- 
tical quality  control  are  ready-made  tools  for  safety  analy- 
sis because  the  safety  professional  has  common  problems  with 
the  quality  inspector:   both  would  like  to  be  everywhere 
simultaneously  to  detect  changes;  and  both  have  to  apply  some 
practical,  effective  approaches  to  their  problems.   Control 
charts  are  used  for  this  purpose.   According  to  Brown  (1976), 
a  control  chart  is  a  visual  means  by  which  an  analyst  judges 
whether  a  process  is  in  control  or  not.   The  measurement 
plotted  on  the  chart  are  those  of  any  random  variable.   Hence 
the  frequency  and  severity  of  accidents,  as  well  as  any  other 
intermediate  indicator  of  hazards,  could  be  plotted.   Judgments 
based  upon  these  plots  determine  if  the  process  is  in  control 
with  respect  to  the  random  variable  under  consideration. 

Figure  8  shows  the  typical  layout  of  a  control  chart. 
The  units  of  the  random  variable  are  given  on  the  vertical 
scale,  indicating  that  the  height  of  the  plotted  point  repre- 
sents the  value  of  the  random  variable  for  the  indicated 
time  period.   The  time  scale,  given  by  horizontal  line 
shows  when  the  value  occurred . 

Measurement  of  central  tendency  and  spread  define  the 
expected  concentration  and  range  of  the  variable.   Thus,  if 
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X     \  !()per  control  limil 


Figure  8.   Sample  Control  Chart 

(Brown,  D.B.  [1976],  p.  230) 


28 


the  variable  behaves  in  a  nonrandom  way,  we  can  conclude  that 
an  outside  influence  is  affecting  the  random  variable.   The 
coininon  way  of  identifying  when  this  occurs  is  through  the 
use  of  an  upper  and  a  lower  control  limit.   These  are  generally 
placed  at  equal  distances  above  and  below  the  mean  line. 

The  measured  values  as  they  are  recorded  in  time  are 
plotted  as  indicated  in  Figure  8.   A  point  falling  above  or 
below  the  control  limits,  respectively,  is  indicative  of  an 
out-of -control  situation,  and  assignable  causes  are  generally 
sought.   There  are  other  indications  of  out-of -control  situa- 
tions, also.   However,  prior  to  discussing  these,  the  means 
for  obtaining  the  control  limits  will  be  given. 

The  procedures  for  setting  control  limits  are  essentially 
the  same  as  those  for  setting  the  acceptance  limits  in  a  test 
of  hypothesis.   The  first  step  involves  the  establishment  of 
significance  level  a,  that  is,  the  probability  of  concluding 
that  the  process  is  out  of  control  when  in  fact  it  is  in  con- 
trol.  If  methods  of  identifying  causes  are  expensive  and 
the  variable  is  not  critical,  a  low  probability  can  be  tolerated 
However,  if  an  early  indication  of  lack  of  control  is  necessary, 
then  a  high  probability  of  this  error  should  be  specified. 
Once  the  value  of  a  is  determined,  the  next  question  involves 
the  definition  of  control.   Quite  often  the  state  "out  of  con- 
trol" occurs  in  one  direction  only,  that  is,  upper  control 
limit  would  be  required  as  it  would  in  most  cases  of  pollution 
measurements  (Figure  9) .   Other  monitoring  of  processes  would 
require  both  an  upper  and  a  lower  control  limit. 
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Figure  9.  Sample  of  a  Safety  Control  Chart  Used  in 
Statistics  Approach  to  Safety  Evaluation 
(Industrial  Engineering^  Dec.  1975,  p.  20) 


In  either  case,  the  value  of  a  chosen  will  represent  the 
total  area  of  probability  in  the  out-of -control  portion  of 
the  chart.   The  upper  and  lower  control  limits  are  obtained 
depending  upon  the  random  variable,  its  distribution,  and 
the  value  of  a  chosen. 

Brown  (1976)  suggests  in  the  following  example  that  the 
frequency  of  accidents  of  a  plant  has  a  normal  distribution 
with  a  mean  of  6  and  a  standard  deviation  of  1.5.   Frequencies 
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for  the  first  6  months  have  been  4,  7,  5,  12,  8,  and  6.   Set 
up  a  monthly  control  chart  for  frequency.   Allow  for  a  .05 
probability  of  calling  a  point  out  of  control  when  it  is  not. 
In  this  example  "out  of  control"  is  strictly  in  terms  of 
an  upper  limit.   However,  the  analyst  chooses  to  set  up  a 
lower  limit  to  provide  possible  evidence  of  a  lowering  of  the 
accident  frequency.   Thus  the  .05  probability  will  be  divided, 
.025  above  the  upper  limit  and  .025  below  the  lower  limit. 
The  upper  limit  becomes 


U.L.   =   X  +  Z  „^c.  a 
.  025   X 


=   6  +  1.96(1.5)   =   8.94 


and  the  lower  limit  is 


.  025   X 


=   6-1.96  (1.5)   =   3.06 


where 


Z   =  ^^^    (which  "standardizes"  any  normally 
^        distributed  random  variable) 


X   = 


n   X. 

iil  ^ 


a 

X 


=  v/^  =    AUx.    -x)^)/n-l   =  E[{x-m)^] 

XX  X 


U^   =   E[X] 
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The  control  chart  is  given  in  Figure  10.   The  fourth  month 
was  obviously  out  of  control,  and  assignable  causes  should  be 
sought.   In  this  example  the  assumption  of  normality  should 
be  tested  since  it  does  not  hold  generally. 


Figure  10.   Control  Chart  for  Example  Described  in 
Text  (Brown,  1976,  p.  231) 


The  construction  of  the  chart  is  simply  a  matter  of  apply- 
ing hypothesis  testing  on  a  continuous  basis.   The  primary 
advantage  is  that  continuous  visual  perception  of  the  random 
variable  is  maintained.   This  continuous  picture  enables  the 
analyst  to  make  judgments  not  otherwise  discernible.   This 
is  not  limited  to  the  upper  and  lower  control  limits  demon- 
strated above.   Other  factors  that  the  analyst  can  use  as 
indicators  of  abnormal  operational  behavior  include: 
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a.  Several  points  (four  or  more)  in  a  row  on  one  side 

of  the  mean  line.   The  probability  of  four  consecutive  points 

4 
on  one  side  is  approximately  . 5  ,  or  .0625. 

b.  Identifiable  cycles.   Here  two  or  three  years  of  history 
may  be  required  to  identify  a  given  month  or  other  period 

of  time  when  the  operation  acts  in  an  irregular  manner. 

c.  Several  points  in  a  row,  either  monotonically  increasing 
or  decreasing  away  from  the  mean  line.   The  probability  of 
this  type  of  trend  is  difficult  to  establish.   However,  since 
these  points  are  all  on  one  side  of  the  mean  line,  the  proba- 
bility will  be  considerably  less  than  .5  ,  where  n  is  the 
number  of  points  exhibiting  this  characteristic. 

In  quality-control  situations,  3a  control  limits  are 
generally  used,  based  on  the  1-in-lOOO  value  of  a  under  the 
normal  distribution  assumption.   The  2a  and  la  lines  may  also 
be  set  up,  however,  to  help  the  analyst  identify  other  out- 
of-control  indicators.   For  example,  two  points  in  a  row 

outside  of  2a  limits  would  have  an  approximate  probability 

2 
of  (.025)   =  .000625,  which  is  about  the  same  as  the  probability 

of  one  point  outside  3a  limits,  assuming  normality.   Although 

control  charts  for  safety  applications  should  not  be  restricted 

to  the  a  =  .001  value,  the  concept  of  intermediate  lines  to 

identify  irregularities  is  a  good  one. 

B.   SYSTEMS  SAFETY  ANALYSIS 

To  understand  the  systems  safety  analysis  we  should  first 
have  a  clear  picture  of  what  a  system  is.   Worick  (1975) 
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defines  a  system  as  an  orderly  arrangement  of  components  which 
are  interrelated  and  which  act  and  interact  to  perform  some 
task  or  function  in  a  particular  environment.   The  main  points 
to  keep  in  mind  are  that  a  system  is  defined  in  terms  of  a 
task  or  function,  and  that  the  components  of  a  system  are 
interrelated,  that  is,  each  part  affects  the  others.   The 
task  or  function  which  a  system  performs  may  be  simple  or 
complex.   Sometimes  it  is  convenient  to  break  up  a  complex 
task  into  simpler  tasks  and  consider  subsystems  of  the  larger 
system.   Subsystems  consist  of  part  of  the  components  of  the 
overall  system  and  perform  a  portion  of  the  overall  task 
(Figure  11) .   The  components  of  a  system  can  cover  a  wide 
range  including  machines,  tools,  material,  environmental  fac- 
tors, people,  documents  (such  as  operating  instructions, 
training  manuals,  or  computer  programs),  and  so  on.   As  part 
of  a  system,  the  components  usually  complement  each  other 
but  it  is  essential  to  recognize  that  a  failure  or  malfunction 
of  any  component  can  affect  the  other  components  and  thus 
degrade  the  perfoinnance  of  the  task. 

The  sequential  steps  required  in  all  system  analyses 
(Figure  12)  are: 

a.  Recognition  that  a  problem  exists  and  that  the  solution 
may  be  amenable  to  systems  analysis  techniques. 

b.  Definition  of  that  problem  in  an  appropriate  form, 
including  a  definition  of  objectives,  requirements,  and  con- 
straints of  times,  resources,  operational  environment,  social 
acceptability,  etc. 
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Figure    12. 


Systems  Development  Flow  Diagram 
(System  Psychology — DeGreene 
[1970] ,    p.  84) 
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c.  Definition  of  system  itself t  in  terms  of  its  hierarchi- 
cal level,  boundaries,  interfaces,  environments,  functions, 
and  constituent  subsystems  and  their  interactions,  usually 
expressed  in  input/throughput/output  terms.   This  iterative 
process  begins  with  gross  approximations  and  works  toward 
minute  preciseness,  involving  test  and  modification  of  the 
original  concept.   The  result  should  be  a  conceptual  model 
amenable  to  quantitative  analysis. 

d.  Definition  of  performance  criteria  for  the  system  as 

a  whole,  for  the  various  levels  of  organization,  and  for  the 
combination  of  its  constituents. 

e.  Definition  of  alternative  configurations  and  their 
evaluation  in  terms  of  costs,  effectiveness,  state  of  develop- 
ment, environmental  constraints,  etc. 

f.  Presentation  of  alternatives  and  tradeoff  results 
to  the  user.   A  number  of  choices  should  be  presented  in 
order  of  preference. 

g.  Performance  of  ongoing,  iterative  engineering  and  human 
factors  analyses  during  systems  development. 

h.   Analyses  of  operational  systems  to  gether  basic  per- 
formance data. 

The  importance  of  these  preliminary  steps  cannot  be  over- 
emphasized.  As  in  any  research,  the  analyst  himself  may 
introduce  bias  in  the  form  of  poor  problem  formulation,  not 
understanding  the  system,  or  in  not  understanding  the  true 
role  of  analysis.   In  some  cases,  it  may  not  be  known  until 
the  system  is  complete  whether  the  problem  was  defined  correctly, 
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There  are  several  methods  which  are  used  for  the  systems 
analysis  techniques,  but  the  author  will  describe  here  the 
fault  tree  and  cost-effective  analysis. 
1.   Fault  Tree  Analysis 

Fault  Tree  Analysis  (FTA)  was  developed  mainly  by 
engineers  who  studied  engineering  systems  in  great  detail, 
with  little  or  no  contribution  by  mathematicians.   A  possible 
explanation  given  by  R.E.  Barlow  (1975) ,  J.B.  Fussell  (1975) 
and  N.D.  Singpurwalla  (197  5)  is  the  fact  that  the  construc- 
tion of  the  fault  tree,  a  basic  step  in  fault  tree  analysis, 
requires  an  intimate  knowledge  of  the  manner  in  which  a  sys- 
tem is  designed  and  operated.   The  mathematician's  lack  of 
familiarity  with  the  operation  of  systems,  and  perhaps  their 
preoccupation  with  mathematically  well-defined  problems,  has 
deterred  their  interest  in  fault  tree  analysis. 

Brown  (1976)  developed  Fault  Tree  and  cost/benefit  analy- 
sis for  choosing  optimal  safety  alternatives.   Brown  shows 
how  negative  utility  amounts  can  be  assigned  to  all  possible 
head  events  and  the  relevant  possibilities  multiplied  by  the 
negative  utilities.   The  results,  which  are  expected  negative 
utility  amounts,  are  called  "measures  of  criticality" . 

Reductions  in  negative  expected  utility  or  criticality 
are  considered  to  be  quantitative  expressions  of  benefits  or 
effectiveness,  and  these  are  then  related  to  costs  to  find 
the  optimal  combination  of  safety  alternatives  for  the  deci- 
sion maker's  cost-benefit  trade-off  function. 
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Using  Brown's  methodology  the  safety  manager  should 
first  utilize  the  fault-tree  analysis  technique  as  a  logical 
approach  to  identify  the  areas  in  a  system  that  are  most 
critical  to  safe  operation. 

According  to  R.E.  Barlow  (1975)  and  H.E.  Lambert 
(1975) ,  FTA  is  one  of  the  principle  methods  of  systems  safety 
analysis.   FTA  evolved  in  the  aerospace  industry  in  the  early 
1960 's.   It  was  the  result  of  a  contract  between  the  Air  Force 
Ballistics  Systems  Division  and  Bell  Telephone  Laboratories 
for  the  study  of  inadvertent  launch  in  the  Minuteman  ICBM 
(Delong,  1970).   After  initial  work  at  Bell  Telephone  Labora- 
tories, development  of  fault  tree  continued  at  the  Boeing 
Company,  where  scientists  devoted  much  effort  to  develop  its 
procedures  farther  and  became  its  foremost  proponents.   The 
principle  of  Boolean  algebra  (Appendix  A)  is  applied  for  FTA. 

Rogers  (1971)  has  referred  to  the  following  six  steps 
that  were  used  in  applying  the  technique  to  the  Minuteman 
Program: 

1.  Define  the  undesired  event. 

2.  Acquire  complete  understanding  of  the  system. 

3.  Construct  the  fault  tree  diagram. 

4.  Collect  quantitative  data. 

5.  Evaluate  fault  tree  probability. 

6.  Analyze  computer  results. 

Undesired  events  requiring  FTA  are  identified  either 
by  inductive  analysis,  such  as  a  preliminary  hazard  analysis. 
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or  by  intuition.   These  events  are  usually  undesired  system 
states  that  can  occur  as  a  result  of  subsystem  functional 
faults. 

FTA  is  a  detailed  deductive  analysis  that  usually 
requires  considerable  system  information.   It  can  be  a  valua- 
ble design  tool.   It  can  identify  potential  accidents  in  a 
system  design  and  can  help  to  eliminate  costly  design  changes 
and  retrofits.   FTA  can  also  be  a  diagnostic  tool.   It  can 
predict  the  most  likely  causes  of  system  failure  in  the  event 
of  a  system  breakdown. 

A  major  difficulty  with  quantitative  fault  tree 
evaluation  is  the  lack  of  pertinent  failure  rate  data.   Even 
in  cases  where  the  data  are  goodk  it  is  not  clear  that  we  can 
justify  one  system  environment,  data  that  were  obtained  in  a 
different  system  environment.   Nevertheless,  quantitative 
evaluations  are  particularly  valuable  for  comparing  systems 
designs  that  have  similar  components.   The  results  are  not  as 
sensitive  to  failure  rate  data  as  in  an  absolute  determina- 
tion of  the  system  failure  probability. 

The  goal  of  fault  tree  construction  is  to  model  the 
system  conditions  that  can  result  in  the  undesired  event. 
One  of  the  advantages  of  manual  fault  tree  construction  is 
that  it  forces  the  analyst  to  understand  the  system  thoroughly 
Before  the  construction  of  a  fault  tree  can  proceed,  the 
analyst  must  acquire  a  thorough  understanding  of  the  system. 
In  fact,  a  system  description  should  be  part  of  the  analysis 
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documentation.   The  analyst  must  carefully  define  the  un- 
desired  event  under  consideration,  called  the  'top  or  head 
event' . 

a.  Event  Description 

A  fault  tree  is  a  model  that  graphically  and 
logically  represents  the  various  combinations  of  possible 
events,  both  fault  and  normal,  occurring  in  a  system  that 
leads  to  the  top  event.   The  term,  event,  denotes  a  dynamic 
change  of  state  that  occurs  to  a  system  element.   System  ele- 
ments include  hardware,  software,  human  and  environmental 
factors. 

b.  Event  Symbols 

The  symbols  shown  in  Figure  13  represent  specific 
types  of  fault  and  normal  events  in  FTA.   The  rectangle  defines 
an  event  that  is  the  output  of  a  logic  gate  and  is  dependent 
on  the  type  of  logic  gate  and  the  inputs  to  the  gate.   The 
circle  defines  a  basic  inherent  failure  of  a  system  element 
when  operated  within  its  design  specifications.   It  is  there- 
fore a  primary  failure,  and  is  also  referred  to  as  a  generic 
failure.   The  diamond  represents  a  failure,  other  than  a  pri- 
mary failure  that  is  purposely  not  developed  further.   The 
switch  event  represents  an  event  that  is  expected  to  occur 
or  to  never  occur  because  of  design  and  normal  conditions, 
such  as  a  phase  change  in  a  system.   The  conditional  input 
may  be  applied  to  any  gate  and  describes  a  condition  which 
must  be  present  to  produce  the  output.   For  example,  an 
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Fault  Event 


Basic  Event 


Undeveloped  Event 


Switch  Event 


Transfer  IN       Transfer  OUT      Conditional  Input 


Figure  13. 


Event  Symbols  Used  in  Fault  Tree  Analysis 
(Brown,  D.B.  [1976],  p.  158  and  Rodgers , 
W.P.  [1971] ,  p.  41) 
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order  sequence  of  the  inputs  to  an  AND  GATE  may  be  described 
as  a  condition  input.   The  triangles  are  used  as  transfer 
symbols.   A  line  from  the  apex  indicates  a  transfer  in,  and 
a  line  from  the  side  shows  a  transfer  out. 

c.  Logic  Gates 

The  fundamental  logic  gates  for  fault  tree  con- 
struction are  the  OR  and  the  AND  gates.   The  OR  gate  des- 
cribes a  situation  where  the  output  event  will  exist  if  one 
or  more  of  the  input  events  exist.   The  END  gate  describes 
the  logical  operation  that  requires  the  coexistence  of  all 
input  events  to  produce  the  output  event.   the  INHIBIT  GATE 
describes  the  relationship  between  one  fault  and  another. 
The  input  event  causes  the  output  event  if  the  indicated  con- 
dition is  satisfied.   If  the  condition  involves  a  specific 
failure  mode,  it  is  represented  by  an  oval.   It  is  shown  in 
a  rectangle  if  the  condition  described  is  one  that  may  exist 
anytime  during  the  life  of  the  system.   The  symbols  for  the 
logic  gates  are  shown  in  Figure  14. 

d.  Construction  Methodology 

The  fault  tree  is  so  structured  that  the  sequences 
of  events  that  lead  to  the  undesired  events  are  shown  below 
the  top  event  and  are  logically  related  to  the  undesired 
event  by  logical  gates.   The  input  events  to  each  logic  gate 
that  are  also  outputs  of  other  logic  gates  at  a  lower  level 
are  shown  as  rectangles .   These  events  are  developed  further 
until  the  sequences  of  events  lead  to  basic  causes  of  interest, 
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Symbols  for  Logic  Gates  Used  in 
Analysis  (Rodgets,  W.P.  [1971], 


Fault  Tree 
p.  40) 
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called  "basic  events".   The  basic  events  appear  as  circles 
and  diamonds  on  the  bottom  of  the  fault  tree  and  represent 
the  limit  of  resolution  of  the  fault  tree.   The  structuring 
process  is  used  to  develop  fault  tree  flows  in  a  fault  tree 
(Figure  15)  when  a  system  is  examined  on  a  functional  basis, 
that  is,  when  failures  of  system  elements  are  considered. 
At  this  level,  schematics,  piping  diagrams,  process  flow 
sheets,  etc.,  are  examined  for  cause  and  effect  types  of 
relationships  to  determine  the  subsystem  and  component  fault 
states  that  can  contribute  to  the  occurrence  of  the  undesired 
event. 

e.  Purpose  of  Fault  Tree  Construction 

The  fault  tree,  once  constructed,  serves  as  an 
aid  in  determining  the  possible  causes  of  an  accident.   When 
properly  used,  the  fault  tree  often  leads  to  discovery  of 
failure  combinations  which  otherwise  might  not  have  been 
recognized  as  causes  of  the  event  being  analyzed.   The  fault 
tree  can  be  used  as  a  visual  tool  in  communicating  and  supporting 
decisions  based  on  the  analysis,  such  as  determining  the  ade- 
quacy of  a  system  design.   The  fault  tree  provides  a  convenient 
and  efficient  format  helpful  for  either  qualitative  or  quanti- 
tative evaluation  of  the  fault  tree,  such  as  determination 
of  the  probability  of  the  occurrence  of  the  top  event. 

f.  Evaluation  of  the  Fault  Tree 

An  objective  of  fault  tree  evaluation  is  to  deter- 
mine if  there  is  an  acceptable  level  of  safety  in  the  proposed 
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The  output  of  in   AND  gate  occurs 
only  if  all  the  inputs  exist. 

The  output  of  an  OR  gate  occurs  if  any  of  the 
inputs  exist. 
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Figure  15.   Levels  of  Fault  Tree  Development  (Barlow, 
R.E.  and  Lambert,  H.E.  [1975],  p.  16) 
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system  design,  i.e.,  will  the  proposed  design  suitably  mini- 
mize the  probability  of  the  occurrence  of  the  top  event. 
If  the  system  design  is  found  inadequate,  then  the  design  is 
upgraded  by  first  identifying  critical  events  (such  as  com- 
ponent failures)  that  significantly  contribute  to  the  top 
event.   Cost  constraints,  contractual  requirements,  and  other 
factors  limit  the  design  changes  that  can  be  made.   Therefore, 
trade-off  studies  are  necessary  to  determine  what  changes  will 
be  incorporated  to  reduce  the  effect  of  the  critical  events. 
When  all  design  changes  are  made,  the  fault  tree  is  re- 
evaluated to  determine  if  the  revised  design  provides  an 
acceptable  level  of  safety  and/or  reliability. 

According  to  Brown  (1976)  the  purpose  of  developing 
a  fault  tree  and  quantifying  it  is  to  effectively  allocate 
the  safety  budget.   To  do  this,  the  various  alternative  safety 
investments  are  considered  in  light  of  their  effect  upon  the 
fault  tree  and  the  resulting  head  event.   A  measure  of  cost/ 
benefit  is  then  determined  for  use  in  decision  making.   Before 
completing  the  presentation  of  Brown's  methodology  some  ter- 
minology as  given  by  Brown  will  be  introduced, 
g.   Cost 

Cost  is  defined  as  the  dollar  outlay  to  pay  for 
the  incorporation  of  a  device,  method,  procedure  and  so  on 
(henceforth  called  a  countermeasure)  into  the  industrial  sys- 
tem for  a  given  unit  period  of  exposure.   Thus  the  cost  of 
devices  that  must  be  periodically  recharged  and/or  replaced 
is  based  on  average  costs  for  a  given  unit  (e.g.,  a  million 
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man-hours  (iranh)  exposure  period) .   Permanent  fixtures,  such 
as  machine  guards,  can  be  prorated  on  the  basis  of  the  life 
of  the  machine.   The  cost  of  educational  programs  can  be 
prorated,  based  upon  their  frequency.   All  countermeasures 
must,  for  comparison  purposes,  have  a  common  denominator, 
h.   Benefit 

Benefit  is  the  negative  utility  reduction. 
Measure  of  benefit  is  the  expected  negative  utility.   There 
is  a  negative  utility  (or  cost  in  terms  of  dollars  and  personal 
well-being)  associated  with  accidents.   This  negative  utility 
depends  upon  the  severity  of  the  accident. 

The  expected  negative  utility  of  the  head  event 
if  it  occurs  can  now  be  calculated  by  the  following: 


N 

E   =     y    p.u. 


i=l 


where : 


P^   =   the  probability  of  occurrence  of  the  i 

severity  class  given  that  the  head  event 
occurs , 


1 


N   =   the  number  of  severity  classes, 

U.   =   the  negative  utility  associated  with  the 
■""     i^^  severity  class. 


An  alternative  method  for  calculating  E  would  be 
more  appropriate  if  the  values  of  negative  utility  from  a 
large  number  of  past  occurrences  of  the  head  event  were 
measured  directly.   Thus  the  expected  negative  utility 
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associated  with  the  head  event  would  be  obtained  from  the 
arithmetic  mean  of  these  measurements: 


n 

E   =   i=^ 
n 


Both  equations  above  are  equivalent  under  the 
conditions  that  there  are  n  severity  classes  (N  =  n)  and  that 
the  probability  of  each  severity  class  is  equivalent  (P.  =  — ) . 
This  occurs  when  each  accident  is  considered  as  a  unique 
situation . 

i.   Cost/Benefit 

This  term  is  a  vague  term  used  in  describing  a 
variety  of  applications.   Here  it  is  defined  as  the  dollars 
spent  per  negative  utility  reduction, 
j .   Criticality 

A  system  is  defined  as  critical  if  there  is  any 
failure  that  will  degrade  the  system  beyond  acceptable  limits 
and  create  a  safety  hazard.   An  absolute  measure  of  criticality 
associated  with  the  head  event  can  be  obtained  as 


C   = 


where : 


C  =   the  expected  negative  utility  associated  with 
the  head  event  in  the  given  time  or  production 
unit. 

P   =   the  head  event  probability  (in  occurrence/mmh) 

E  =   the  expected  negative  utility  (in  dollars/ 
occurrence  or  workday/occurrence  etc.). 
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k.   Determination  of  Head-Event  Probability 

The  value  of  P  can  be  obtained  assuming  that  a 
proper  unit  of  time  or  production  has  been  deterinined  to 
adequately  define  one  trial. 

p   =   Jl 
N 
u 

where : 

N,   =   the  number  of  occurrences  of  the  head  event 
in  the  trials  given  by  the  chosen  time  or 
production  unit. 

An  alternative  way  to  determine  P  is  by  using  the 
fault  tree  end  branch  probabilities.   This  is  necessary  if 
the  effect  of  alternative  countermeasures  is  to  be  determined. 

In  the  OR  situation,  any  of  the  events  will  cause 
the  subsequent  event  to  occur  and,  therefore,  assuming  inde- 
pendence, the  probability  of  occurrence  of  the  subsequent 
event  is  given  by 


n 

P    =   1  -   n  (1  -  q.) 
^         i=l 


where : 

+■  y> 
q.   =   the  probability  of  the  i    causal  event. 

n   =   the  number  of  parallel  branches. 

In  the  AND  situation,  all  the  events  must  occur 
for  the  subsequent  event  to  occur  and,  therefore,  assuming 
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independence,  the  probability  of  occurrence  of  the  subsequent 
event  is  given  by 


n 
A      i  =  l   ^ 


Through  a  reiterative  process  the  probability  of 
the  head  event  can  be  determined  from  a  knowledge  of  the 
probabilities  of  the  branch  events.   This  is  the  value  of  P 
which  was  given  in  the  equation  C  =  PE.   A  system  modifica- 
tion will  produce  a  change  in  this  value  of  expected  negative 
utility,  thus  providing  the  measure  of  benefit. 

Brown  (1976)  gives  various  examples  to  demonstrate 
the  entire  procedure. 
2 .   Example 

Figure  16  is  an  example  fault  tree  for  developing 
the  head  event  "Chip  in  Eye  (Grinding)".   This  particular  fault 
tree  is  to  analyze  the  specific  type  of  eye  injury  that  might 
be  caused  by  the  grinding  operation.   Those  who  might  have 
this  accident  fall  into  two  mutually  exclusive  and  all- 
encompassing  categories:   (1)  operators  and  (2)  nonoperators . 
Further,  assume  that  the  accident  will  not  occur  if  adequate 
eye  protection  is  worn.   Therefore,  the  two  events  shown  illus- 
trate the  first  breakdown.   The  event  "Operator  Fails  to  Wear 
Safety  Glasses"  has  an  abbreviated  label  which,  if  spelled  out 
in  detail,  would  read  "Operator  Fails  to  Wear  Safety  Glasses 
and  Is  Injured  by  Chip  in  Eye." 
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Figure  16.   Fault  Tree  Illustrated 
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The  AND  relationship  asks  the  question:   "What  must 
happen?"  not  "What  could  happen?"   Four  things  must  occur  in 
order  for  the  nonoperator  to  be  injured  in  this  way.   These 
four  are  listed  appropriately  under  the  AND  gate. 

The  event  "Motive  to  Go  into  Area"  analyzed  into  the 
specific  reasons.   This  eventis  used  under  OR  gate  here. 

In  Figure  17  the  probabilities  of  occurrence  are  given 
I   for  the  end  branch  events  for  any  million-man-hour  period. 
Suppose  that  records  show  that  in  the  past  there  have  been 
10  accidents  of  this  type,  of  which  7  were  First  Aid,  2  were 
j   Temporary  Total  (man  had  to  leave  job) ,  and  one  resulted  in 
a  Permanent  Partial  (caused  permanent  eye  damage) .   An  example 
of  negativue  utility  schedule  is  given  in  Table  I. 


Table  I 
An  Example  of  Negative  Utility 


Severity 
Classification 

Severity 

Negative 
Utility 

1 

First  Aid 

20 

2 

Temporary  Total 

345 

3 

Permanent  Partial 

2,500 

4 

Permanent  Total 
(including  fatalities) 

21,000 

The  value  of  negative  utility  need  not  be  a  dollar  figure 
if  other  intangibles,  such  as  social  costs,  are  to  be 
considered.   For  this  example,  however,  First  Aid  was 
a  dollar  value  per  case  estimated.   All  other  figures 
are  average  costs  per  case  given  by  the  National 
Safety  Council,  'Accident  Facts',  1971. 
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P  =  Probability  of /4  =  0  0522 
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Figure  17. 


Fault  Tree  Illustrated  the  Probabilities 
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The  expected  negative  utility  of  this  accident  is 

E   =   .7(20)  +  .2(345)  +  .1(2500)   =   333 
The  probability  of  the  OR  gate  given  last: 


P^   =   1  -  (1  -0.05)  (1  -  .5)  (1-  .01)   =   1  -  .8935 
=   .1065 


The  probability  of  the  AND  gate  is: 

P^   =   (.8)  (.1065)  (1)  (.5)   =   .0426 

The  probability  of  the  head  event  is: 

P   =   1  -  (1  -  .01)  (1  -  .0426)   =   1  -  (.99)(.9574) 
=   .0522 

This  is  the  probability  of  occurrence  of  the  head  event,  in 
any  million  manhours  of  exposure. 

The  criticality  associated  with  the  head  event  is: 

C   =   P  .  E   =   (.0522)  (333)   =   17.38 

This  example  will  be  pursued  a  bit  further  to  deter- 
mine how  modifications  on  the  fault  tree  are  handled.   If 
money  is  spent  to  improve  the  safety  of  this  system,  one  or 
more  of  the  basic  event  probabilities  in  the  fault  tree  should 
be  reduced  or  else  the  expected  severity  should  be  reduced. 
If  not,  either  the  expenditure  should  not  be  made,  or  else 
the  fault  tree  is  incorrect.   A  reduction  in  the  basic  event 
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probabilities  will  always  reduce  the  probability  of  the  head 
event,  P,  and  therefore  it  will  also  reduce  the  criticality, 
C,    of  the  event.   The  amount  by  which  the  criticality  is 
reduced  will  provide  a  measure  of  benefit  for  the  change  that 
was  made.   Hence  a  measure  of  benefit  can  be  estimated  for  any 
safety  investment. 

Consider  three  proposed  countermeasures  to  reduce  the 
probability  of  the  head  event  "Grinding  Chip  in  Eye"  originally 
presented  in  Figure  16.   Assume  the  three  alternatives  were 
given  as  in  Table  II. 

Table  II 
Three  Proposed  Countermeasures  and  Associated  Cost 


Alternative 

Description 

Prorated 
Cost/mmh 

Effect 

1 

Ensure  that  opera- 
tor stops  opera- 
tion whenever 
anyone  enters  area 

$25 

Reduce  proba- 
bility of 
event  G  to 
.05 

2 

Move  storage 
area  away  from 
grinding  area 

$15 

Reduce  proba- 
bility events 
H  and  I  to 
zero 

3 

Both  1  and  2 

$30 

Same  effects 
as  both  1 
and  2 

Let's  calculate  the  probability  of  head  event,  criticality, 
savings,  and  cost/benefit. 
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Alternative  1 

P   =   1-  (1  -  0.01)  (1  -  (0.8)  (.1065)  (1.0)  (0.05) 
=   1  -  0.9858   =   0.0142 

C   =   P  •  E   =   (0.0142)  (333)   =   4.73 

Savings   =   17.38  -  4.73   =   12.65 

Cost/Benefit   =   25/12.65   =   1.98 

Alternative  2 

P   =   1-  (1  -  0.01)  (1  -  (0.8)  (1  -  (1-0)  (1-0)  (1-0.01) )  (1.0)  (0.5) ) 
=   1  -  0.986   =   0.014 

C   =   (0.014)  (333)   =   4.66 

Savings   =   17.38  -  4.66   =   12.72 

Cost/Benefit   =   15/12.72   =   1.18 

Alternative  3 

P   =   1  -  (1  -0.01)  (1  -  (0.8)  (1  -  (1-0)  (1-0)  (1-0.01) )  (1.0)  (0.05) ) 
=   1  -  0.9896   =   0.0104 

C   =   (0.0104)  (333)   =   3.46 

Savings   =   17.38  -  3.46   =   13.92 

Cost/Benefit   =   30/13.92   =   2.16. 
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Summary  for  alternatives  are  shown  in  Table  III. 

Table  III 
Three  Alternative  Cost/Benefit  Analyses 


Alternative 

Cost 

Original 
Criticality 

New 
Criticality 

Benefit 

Cost/Benefit 

1 

$25 

17.38 

4.73 

12.65 

1.98 

2 

$15 

17.38 

4.66 

12.72 

1.18 

3 

$30 

17.38 

3.46 

13.92 

2.16 

The  best  investment  is  the  one  with  the  lowest  cost/ 
benefit  figure.   Alternative  2  is  superior  to  the  others  in 
terms  of  cost/benefit. 

C.   CRITICAL  INCIDENT  TECHNIQUE  (CIT) 

This  technique  is  widely  used  as  a  method  of  discovering 
and  attempting  to  reduce  or  control  hazardous  situations  be- 
fore accidents  occur.   CIT  examines  previously  experienced 
difficulties  by  interviewing  persons  involved.   It  is  based 
on  collecting  information  on  hazards,  near  misses,  and  unsafe 
conditions  and  practices  from  operationally  experienced  per- 
sonnel.  It  can  be  used  beneficially  to  investigate  man-machine 
relationships  in  past  or  existing  systems  and  to  use  the 
information  learned  during  the  development  of  new  systems,  or 
for  the  modification  and  improvement  of  those  already  in 
existence.   The  technique  consists  of  interviewing  personnel 
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regarding  involvements  in  accidents  or  near  accidents;  diffi- 
culties, errors,  and  mistakes  in  operations;  and  conditions 
that  could  cause  mishaps.   The  surveys  generally  request 
the  persons  interviewed  to  include  their  own  experiences  and 
also  experiences  of  other  personnel  whom  they  have  actually 
observed.   The  person  is  asked  to  describe  all  near  misses 
or  critical  mishaps  that  he  can  recall. 

In  effect,  the  CIT  accomplishes  the  same  end  result  as  an 
accident  investigation:   identification  through  personal  in- 
volvement of  a  hazard  that  has  or  could  result  in  injury  or 
damage.   When  the  witnesses  who  observed  a  mishap  or  near 
miss,  but  were  not  participants,  are  added  to  those  who  were 
involved,  an  extremely  large  population  is  available  from  which 
information  on  accident  causes  can  be  derived. 

Even  isolated  incidents  reported  by  the  technique  can  be 
investigated  to  determine  whether  corrective  action  is  necessary 
or  advantageous.   However,  when  a  large  number  of  persons  are 
interviewed  regarding  similar  types  of  equipment  or  operations, 
similarities  begin  to  appear  in  reports  of  hazards  and  near 
misses.   Where  these  indicate  deficiencies,  difficulties,  or 
other  inadequacies,  they  can  be  accepted  as  indicators  of 
areas  in  which  improvements  are  necessary  in  the  design  of  a 
product  or  system. 

This  technique  provides  a  source  of  data  on  errors  that 
contribute  to  critical  and  catastrophic  accidents,  and  obtains 
information  directly  from  operators,  who  are  less  reluctant 
to  admit  errors  in  nonaccident  situations  than  in  accident 
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situations.   The  CIT  has  been  used  in  evaluation  of  aircraft 
pilot  safety  and  has  proven  beneficial  as  a  qualitative 
safety  technique. 

Fitts  and  Jones  (1947)  used  this  technique  very  effec- 
tively after  World  War  II  when  they  conducted  interviews  with 
Air  Corps  pilots  on  errors  made  in  operating  aircraft  controls 
and  in  reading  aircraft  instruments.   Figure  18  indicates  the 
classifications  of  460  pilot  errors  made  in  operating  aircraft 
controls.   Over  8  0  percent  of  the  errors  reported  can  be  con- 
sidered as  errors  of  design:   design  of  controls,  their 
arrangements,  and  their  locations. 

Fitts  and  Jones  also  made  numerous  recommendations  for 
changes  that  would  reduce  human  error,  improve  controls,  and 
increase  system  effectiveness.   These  recommendations,  many 
of  which  were  incorporated  in  later  aircraft  and  in  human 
engineering  standards,  are  quoted  here  to  illustrate  benefits 
that  can  be  generated  by  this  technique  as  a  method  of  developing 
accident  prevention  measures: 

a.  More  than  half  of  all  errors  in  operating  cockpit  con- 
trols can  be  attributed  directly  or  indirectly  to  lack  of 
uniformity  in  the  location  and  mode  of  operation  of  controls. 

b.  Substitution  errors  can  be  reduced  by  (a)  uniform  pattern 
arrangement  of  controls;  (b)  shape-coding  of  control  knobs; 

(c)  warning  lights  inside  the  appropriate  feathering  button; 
and  (d)  adequate  separation  of  controls. 

c.  Adjustment  errors  can  be  reduced  by  (a)  automatic  fuel 
flow  control;  (b)  simplified  one-step  operation  of  wheels  and 
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LiUBSl  I  r  U  r  KJN  E  H  ROHS       confusing  one  control  with  another,  or  (ailinq  to  identify  a  control  when 
ii  wcis  iii'fiied 

,1         UsiiK)  ihtf  wtuiiq  throitif  quadrant  control  (confusing  mixture,  prop  pitch,  throttle,  etc) 

t)         CiKilusiiig  tlap  diifl  whetl  controls 

c.        Qpei.iiiiiy  d  conimi  tor  ihe  wrong  enqine  (feathering  button,  ignition,  mixture,  prop  pitch, 

tluoMie,  etc  ) 

d        FdiJKig  to  uieniify  the  Uniding  light  switch  or  confusing  it  with  some  other  control 

e        Contusing  other  controls  (alarm  bell,  bomb-bay  door,  carburetor  heat,  cockpit  heater, 

dK)(i()<it)le  gas  tanks,  enit^rgency  bomb  release,  engine  heat,  intercooler,  oil  bypass,  oil  colter 
parking  l)rake,  pilot  heal,  ladio  tuning  control,  salvo  switch,  trim  tab,  wobble  pump) 

TOTAL 


No.  of 

Errors 


21 

229 


Percent 
Errors 


89 

19 

72 

16 

36 

8 

11 

2 

_5 

50 


ADJUS  TMENT  E  RRORS     of'srating  a  control  too  slowly  or  too  rapidly,  moving  a  switch  to  the  wrong 
position   or  following  the  wrong  sequence  in  operating  several  controls 

a.  Turning  fuel  s»Hector  switch  to  the  wrong  tank 

h  Following  wrciig  sequence  in  raising  or  lowering  wheels 

c.  Failing  to  obt.iin  desired  flap  setting 

d  Adding  power  loo  suddenly  without  proper  change  m  trim 

e.  Failing  to  lock  or  unlock  throttles  properly 

t  Failing  to  roll  m  trim  fast  enough 

g.  Failing  to  dd|iist  otiier  controls  properly 
TOTAL 


19 

4 

18 

4 

17 

4 

9 

2 

5 

1 

4 

1 

n 

J 

83 

18 

FORGE  TTING  ERRORS,     tailing  to  check,  unlock,  or  use  a  control  at  the  proper  time 

a.  Taking  off  with  flight  controls  locked  (aileron,  elevator,  rudder,  or  all  controls  locked) 

b.  Forgetting  generator  or  magneto  switch 

c.  FoKietting  to  make  proper  engine  or  propeller  control  adjustments  (mixture,  prop  pitch,  etc.) 
d  Forgetting  to  lower    lock  or  check  landing  gear 

e.  Taking  off  wiiti  wrong  trim  settings 

f  Taking  off  withou  t  removing  pitot  cover 

g.  Forgetting  to  operate  other  controls  (bomb-bay  doors,  bomb-rocket  selector  switch,  coolant 
shutter,  flaps,  auxiliary  fuel  pump,  fuel  selector,  hydraulic  selector,  lights,  PDI  switch,  pitoi 
he.it,  tail  whfel  lock  ) 

TOTAL 


16 

4 

14 

3 

11 

? 

7 

7 

6 

) 

4 

1 

83 


5 
18 


•)         HL  Vf-HSAL  t  HHUHS       nioviny  j  comroi  ,i<  ,  direiMioii  opposite  to  that  necessary  to  pioiluv.t  ,t 
Ifjii  c'd  result 

,1         Mjkiny  ifvt,i  s»:d  li  nil  cuf  reclion 
li         Mdkiny  level  it'll  winy  Hap  dUiustiiicnl 

I  Mukiriy  levfisLtl  iiioveiiient  ol  an  enyiiit  or  propellor  looiiuI  (mixture,  prop  pilch,  c;tc  l 

tl         MjkiiKj  iL'veisfd  iiiovemeiu  ol  sunuf  oltiei  Lontrol 
[tjTAL 

'..         UNIN  !  l-N  I  lUIMAL  At.,  1  IVA  I  lUN        iiKuiverttiitly  uperoliny  u  u;nirol  without  being  aware  ut  h 

(LJivikcs,  Ljiliuretur  IilmI    cuwI  Haps,  yeiieialoi,  Kjiuliun,  lyniliuii,  iiwerlef,  landiny  year,  liylils   iiMslei 
■  will  li,  (jitol  tifdt,  idilio  iigjerctidM)t:r  I 

li         UIMAbLt    (O  REACH  A  I, UNI  HOL     jli  ..leiii  or  near  jccident  resulting  from  '  pulling  hedd  m  cin.i. 
pit  ■  to  yrasp  a  coiiltol,  or  inulnlity  to  tcdi.li  j  cunliol  at  all  (Cdiburetor  heat,  fuel  selector 
iiyilrdulic  switcfi    Idiiiliny  ytjai    no-.e  whei.-;  i  idok    rudilers) 


6 

b 

/ 

27 


24 


Figure   18. 


Classification  of  460  Errors  Made  by  Pi 
in  Operating  Aircraft  Controls  (Haimner, 
1972,  p.  189) 


14 

lots 
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flaps;  (c)  easily  accessible  and  continuously  operable  trim 
controls;  and  (d)  improved  throttle  locks. 

d.  Forgetting  errors  can  be  eliminated  almost  entirely  by 
adherence  to  uniform  and  "natural"  directions  of  control 
movement . 

e.  Unintentional  activation  of  controls  can  be  remedied  by 
application  of  existing  anthropometric  data  on  body  size 

and  use  of  a  maximum  reaching  distance  of  28  inches  from  the 
shoulder  for  all  controls  used  during  critical  procedures. 
The  CIT  procedure  was  described  by  Tarrants  as  carried 
out  at  one  plant  of  the  Westinghouse  Company.   The  steps  may 
be  summarized  as  follows: 

a.  A  group  of  employees  with  previous  experience  and 
involvement  in  manufacturing  processes  and  equipment  was 
selected.   Each  person  included  was  listed  according  to  vari- 
ous factors  to  produce  as  wide  a  range  of  experience  as 
possible.   Representatives  were  selected  randomly  from  each 
factor  group. 

b.  The  participants  were  interviewed  and  informed  of  the 
study  and  its  objectives.   They  were  given  an  opportunity  to 
withdraw  from  participation. 

c.  At  the  end  of  the  interview  the  participant  was  given 
a  copy  of  the  statement  on  the  study  and  its  objectives  and 
a  list  of  typical  incidents  gathered  at  other  plants.  This 
procedure  was  to  stimulate  the  recall  process. 

d.  Participants  were  asked  to  describe  any  incidents  that 
they  could  recall,  whether  or  not  they  had  resulted  in  injury 
or  property  damage.   They  were  asked  whether  they  recalled 

62 


any  incident  similar  to  those  that  had  occurred  at  other 
plants,  as  described  on  the  list  they  had  been  provided. 

e.   Questioning  was  carried  on  until  human  errors  or  un- 
safe conditions  in  any  recalled  incident  could  be  described. 

The  20  participants  related  389  incidents  of  117  differ- 
ent types.   Over  50  percent  more  potential  accident  causes 
were  found  by  this  method  than  had  been  identified  from  acci- 
dent records.   One  participant  estimated  that  almost  70  per- 
cent of  the  problems  reported  occurred  every  day,  indicating 
an  almost  constant  exposure  to  danger.   Once  a  potential 
accident  has  been  reported,  the  hazards  are  corrected  so  that 
a  real  accident  will  not  occur.   As  these  hazards  are  eliminated 
or  reduced  so  should  accident  frequency  and  severity  rates . 

The  major  deficiency  of  this  method  is  that  its  effective- 
ness will  be  dependent  upon  all  employees  reporting  those 
potential  accidents  (incidents)  in  which  they  are  involved. 
Usually  employees  will  be  reluctant  to  do  so.   They  are  worried 
about  their  supervisors  attitude,  their  own  personal  records 
and/or  spoiling  the  company's  safety  record.   Thus  data  with 
some  degree  of  bias  are  introduced. 
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III.   STATEMENT  OF  PROBLEM 

Through  the  literature  survey,  several  methods  among  the 
existing  safety  measurement  techniques  have  been  discussed 
for  measurement  of  flight  safety.   From  the  above  discussion 
it  is  apparent  that  the  measurement  of  flight  safety  is  an 
area  for  research  and  development  which  will  allow  major 
improvement  in  overall  flight  safety  programs, 

A  most  important  aspect  in  the  development  of  an  effective 
safety  program  is  collection  and  evaluation  of  data.   The 
primary  goal  of  any  safety  program  is  to  prevent  accidents. 
Accident  prevention  is  best  pursued  within  the  framework  of 
a  systematic  program.   Detailed  and  well-selected  collection 
of  factual  data  is  the  first  step  in  the  development  of  an 
effective  safety  effort.   By  means  of  an  overall  evaluation 
of  safety  by  analysis  and  dissemination  of  this  data,  acci- 
dents can  be  predicted  and  prevented. 

The  Korean  Air  Force  is  currently  collecting  data  on  air- 
craft accidents.   Data  categories  collected  are  as  follows. 

a.  Accident  rate  and  flight  time  per  model  and  year 

b.  Total  accident  rate,  pilot  and  aircraft  loss  per  year 

c.  Accidents  by  general  factors  (pilot,  maintenance, 
material,  supervisor,  etc.) 

d.  Accidents  in  detail  per  factors  (e.g.,  pilot  factor: 
spin,  disorientation,  unusual,  air  collision,  etc.) 
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e.  Major  accidents  per  flight  time  (e.g.,  400  ~ 500  hrs:  8, 
900-1000  hrs:  A,    1700-1800  hrs:  1,  etc.) 

f.  Major  accidents  per  flight  phases  (take  off,  climb, 
in  flight.  Let  Down,  landing) 

g.  Major  accidents  per  missions  (Air  to  Air,  Air  to  Ground, 
Instrument  Flying,  etc.) 

h.   Major  accidents  per  rank 

i.   Aircraft  accident  cost. 

Many  of  the  data  categories  listed  above  are  useful  and 
lend  themselves  to  analysis  (Items  a,  b,  e).   There  are,  how- 
ever, some  major  deficiencies  in  data  being  collected  by  the 
Korean  Air  Force.   From  the  accident  prevention  viewpoint 
and  for  the  analysis  of  pilot  error,  it  would  be  better  to 
categorize  the  pilot  errors  of  item  c  as  follows: 

a.  Design-induced  pilot  factor  (e.g.,  instruments  that 
can  not  be  seen  properly  because  of  their  location) . 

b.  Operations-induced  pilot  factor  (e.g.,  air  traffic 
control  terminology) . 

c.  Environment-influenced  pilot  factor  (e.g.,  weather 
phenomena  such  as  fog  or  thunderstorms) . 

d.  Innate  pilot  factor  (e.g.,  poor  technique,  misuse  of 
controls,  medical  and  psychological  conditions). 

Specifically,  the  data  of  items  g  and  h  are  inadequate. 
For  example,  item  g  must  include  flight  time  or  sorties.   That 
is,  accident  rate  must  be  calculated  for  each  mission.   Item 
h  must  consider  the  total  flight  time  and  pilots  of  each  rank. 
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For  example,  suppose  the  cumulative  number  of  pilots,  flight 
time,  and  accidents  for  10  years  are  shown  in  Table  IV. 

Table  IV 
Example  Data  for  Ranks  by  Pilots,  Flight  Time  and  Accidents 


Rank 

2nd  Lt. 

1st  Lt. 

Capt. 

Maj  . 

Lt.  Col. 

pilots 

400 

1,000 

1,500 

800 

300 

flight 
time 

40,000 

150,000 

450,000 

160,000 

30,000 

acci- 
dents 

3 

18 

19 

9 

9 

Then, 


Accident  rate   = 


(Number  of  pilots  in  each  rank/total  pilots] 

X  Accidents   100,000 

Flight  time  of  each  rank 


Total  pilots   =   400  +  1,000  +  1,500  +  800  +  300   =   4,000 


Accident  rate  of 
2nd  Lt. 


(400/4000)  X  3  X  100,000   ^    ^^ 
40,000 


By  the  same  formula,  accident  rates  of  1st  Lt.,  Capt.,  Maj., 
and  Lt.  Col.,  are  3.0,  1.58,  1.13,  and  2.25. 

From  the  data  collected  above  we  can  only  use  control 
chart  techniques  because  the  data  was  not  collected  in  detail. 
But  the  problem  is  that  it  is  difficult  to  evaluate  the  over- 
all safety  effectiveness  by  this  method  because  the  control 
chart  uses  only  the  frequency  or  severity  of  accidents  vs. 


66 


time  (year,  month,  or  week) .   Accidents  must  be  considered 
as  multiple  causation  events,  i.e.,  rarely  is  a  single 
factor  solely  responsible  for  the  event. 

The  present  thesis  effort  has  been  designed  to  examine 
data  currently  collected  by  the  K.A.F.  and  make  recommendations 
which  will  improve  data  collection  procedures  and  subsequent 
analysis. 
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IV.   APPROACH  TO  MEASUREMENT  OF  FLIGHT  SAFETY 

Several  measurement  techniques  applicable  to  flight 
safety  were  presented  in  the  literature  survey.   The  problem 
is  how  should  the  data  be  collected  to  efficiently  apply  such 
measurement  techniques?   The  author  will  present  several 
methodologies  to  collect  and  apply  data. 

A.   CONTROL  CHARTS 

The  primary  objective  of  this  method  is  to  show  compari- 
sons among  accidents  which  occurred  in  a  given  period  and  to 
visually  indicate  out  of  control  situations  by  plotting  fre- 
quency of  accidents  vs.  time  (year,  month,  or  week)  and  upper/ 
lower  control  limits.   A  point  falling  above  or  below  the  con- 
trol limits,  respectively,  is  indicative  of  an  out-of -control 
situation,  and  assignable  causes  are  generally  sought.   To 
measure  flight  safety,  we  actually  need  only  the  upper  control 
limit. 

It  is  easy  to  collect  these  data.   The  K.A.F.  does,  in 
fact,  collect  monthly  and  yearly  aircraft  accident  data.   In 
addition,  it  may  be  advantageous  to  add  daily  and  weekly 
data  to  monthly  and  yearly  statistics. 
Example 

1.  Data  for  accident  rate  (major,  minor,  or  major  +  minor) 
per  week  (given  period) . 

2.  Pilot  loss  rate  per  year,  month. 
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If  the  above  data  was  collected,  it  would  be  possible  to 
determine  trends  of  accidents  on  a  daily  basis.   In  particu- 
lar, we  could  analyze  the  accident  factors  (pilot  error, 
material  failure,  supervisor,  maintenance,  environment)  from 
item  1  by  observing  the  upper  control  limit  zone. 
Analysis  of  Existing  Data 

The  aircraft  accident  rate  of  the  K.A.F.  is  as  in  Table  V 


Table  V 
K.A.F.  Accident  Rate  by  Year 


Year 

70 

71 

72 

73 

74 

75 

76 

77 

78 

79 

Acci- 
dent 
rate 

10.8 

7.6 

7.3 

9.7 

9.5 

5.7 

5.0 

1.4 

5.6 

4.2 

Then  the  control  chart  of  this  data  is  shown  in  Figure  19. 


^ 
S 


.'3 
o 


70    71    72    73    74    75    76    77    78    79 
Figure  19.   Control  Chart  Applied  to  K.A.F.  Data 


U.L, 


X 


L.L 


Year 
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From  the  above  data. 


—  r       i  66.8  r       r  n 

1  =  1 


s  = 


'J{1^\    -    (j;x^)^/n]/n-l   =   2.87 


The  t  distribution  is  used.   For  a  =  0.05, 


U.L.   =   X  +  t        —  =   6.68  +  t„  ^-.^    2_^^ 
=   6.68  +  2.262x2_l82  ^   g^-73 


/To 


L.L.   =   X  -  t         4:  =   6-68  -  2.262  X  mZ 
n-l,l-|  /n  /lO 

=   4.63 


The  accidents  of  70,  73,  and  74  are  out  of  the  control 
limit.   So  we  have  to  analyze  the  accident  causes  of  these 
years  to  prevent  or  reduce  accidents  in  the  future.   Also  we 
have  to  prepare  accident  prevention  program  according  to  the 
outcome  of  analysis. 

Let' s  take  a  =  .01. 

U.L.   =   X  +  t         .—  =   6.68  +  t„   QQ^  2^^ 
n-1,1-2'   *^^^  *'^10 

=   6.68  +  3.25  X  lill  =   9.63 

/lO 


70 


L.L.   =   X  -  t 


a 


n-l,!  — 


_S 


^-     =   6.68  -  3.25  X 


2.87 

/lo 


=   3.73 


The  accidents  of  70  and  73  year  are  yet  out  of  control 
limit.   The  control  chart  is  almost  the  same  as  test  of 
hypothesis . 


Hq:   U  =  Uq 


H^:   y  >  Uq 


The  acceptance  and  rejection  regions  are  illustrated  in 
Figure  20.   Here  assume  that  the  hypothesis  is  true  and 
use  the  value  of  a  to  determine  the  "cut-off"  point  for 
acceptance  or  rejection.  a   is  the  probability  of  rejection 
given  that  the  hypothesis  H»  is  true. 


^O''      ^   =  ^0 


U.L. 


Accept 


Reject 


Figure  20.   Acceptance  and  Rejection  Region 


For  Hq:   y  =  u-  and  H, :   y  >  y^,  assuming  that  Hq  is 
true,  the  distribution  is  centered  at  y^.   Now  according  to 
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the  definition  of  a  we  will  accept  a  probability  of  rejecting 
H-  even  though  it  is  true. 
Example 

Aircraft  accident  rate  of  the  K.A.F.  was  supposed  to  be 
reduced  up  to  average  5.0  from  19  70  to  1979.  Was  the  acci- 
dent level  reduced  significantly? 

H- :   y  =  Pq  (Accident  level  was  reduced  significantly) 

H,  :   u  >  ij»  (Accident  level  was  not  reduced 
significantly) 

Then  from  accident  data  given  above : 

0     n-l,l-o<  ^ 
=   5.0  +  tq  ^  qc:  •  ^-^^   (a  =  0.05) 

^/^-y^   /lo 

=   5.0  +  1.833  •  -^1^  =   6.66 

/lO 

We  know  x  =  6.68.   Thus  x  >  U.L.   This  means  H-.  is  rejected 
and  H, :   u  >  y^  is  accepted.   Therefore  we  can  conclude  that 
the  K.A.F.  has  not  yet  reduced  the  aircraft  accident  success- 
fully within  given  period.   If  a  increases,  the  value  of  the 
U.L.  decreases  and  the  probability  of  acceptance  H^  decreases 
more. 

B.   FAULT  TREE  ANALYSIS  (FTA) 

Fault  tree  analysis  can  be  used  to  improve  flight  safety 
through  the  identification  of  safety  critical  items  and  make 
cost  effective  recommendations  for  their  improvement.   The 
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identification  of  failures  which  impact  the  safety  of  a  com- 
plex mechanical  system  of  aircraft  requires  a  disciplined 
formal  methodology  capable  of  addressing  the  causes  of  failure 
and  failure  interactions  at  low  levels  of  complexity  which 
influence  the  entire  system.   FTA  can  provide  such  a  disci- 
plined methodology  and  also  be  applied  to  quantitatively 
identify  critical  modes  of  failure  (both  hardware  and  human) 
whose  occurrence  could  cause  a  hazard  in  flight.   The  appli- 
cation of  FTA  initially  requires  the  definition  of  a  system 
and  once  the  system  is  defined  the  basic  events  are  identi- 
fied by  starting  with  the  accident  and  looking  for  its  cause 
at  a  lower  level  of  complexity.   By  repetition  of  this  cause 
and  effect  relationship,  the  most  elementary  cause  is  finally 
deduced.   The  interconnections  of  the  causal  events  with  logic 
symbols  form  the  branches  of  the  fault  tree.   The  quantita- 
tive evaluation  of  the  probability  of  system  failure  requires 
the  collection  of  failure  rate  data  from  which  basic  proba- 
bilities are  determined.   These  basic  event  probabilities 
are  combined  using  rules  of  Boolean  algebra  to  determine 
criticality  of  each  basic  event.   Based  on  relative  criti- 
calities,  cost  effectiveness  techniques  can  be  used  to  decrease 
probabilities  of  basic  hazards. 

A  fault  tree  is  a  failure  analysis  technique  which  analyzes 
system  failures  beginning  at  the  highest  level  of  complexity 
and  ending  at  the  lowest  level  of  complexity.   The  upper  most 
event  is  identified  as  an  accident  which  may  have  several 
degrees  of  severity.   The  degree  of  severity  is  not  identified 
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on  the  fault  tree  diagram  but  is  accounted  for  in  the  cost 
effectiveness  calculation.   The  tree  construction  is  a  logi- 
cal process  producing  a  graphical  display  of  events  such 
that  all  possible  causes  of  a  particular  failure  are  shown 
below  that  failure.   Subsystem  failures  are  further  subdivided 
and  depicted  in  greater  detail  until  the  bottom  of  the  tree 
is  reached.   The  tree  is  structured  to  systematically  show 
contributory  events  and  failures  and  their  relationship  to 
each  other  and  to  the  accident.   Each  component  of  the  sub- 
system capable  of  producing  an  event  is  examined  and  how  its 
failure  would  contribute  to  a  mishap  determined. 

According  to  Hammer  (197  2) ,  in  the  application  of  the 
fault  tree  methodology  the  following  assumptions  are  generally 
made,  concerning  the  characteristics  of  components,  condi- 
tions, actions  and  events: 

a.  Components,  subsystems  and  similar  items  can  have  only 
two  conditional  modes;  they  can  either  operate  successfully 
or  fail.   No  operation  is  partially  successful. 

b.  Basic  failures  are  independent  of  each  other. 

c.  Each  item  has  a  constant  failure  rate  that  conforms 
to  an  exponential  distribution. 

The  benefit  of  the  generalized  fault  tree  structure  is 
realized  through  the  general  applicability  of  the  improvement 
recommendations,  derived  from  the  fault  tree  analysis. 

The  author  will  draw  a  fault  tree  diagram  based  on  the 
K.A.F.  aircraft  accident  data.   The  primary  factors  of  K.A.F. 
aircraft  accidents  in  the  1970 's  were  classified  into  six 
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categories,  i.e.,  pilot,  maintenance,  material,  supervisory, 
environmental,  and  unknown  factor.   Fault  tree  must  include 
detailed  fault  factors  from  top  structure  to  subsystem,  but 
K.A.F.  data  has  not  been  collected  in  sufficient  detail  to 
evaluate  the  most  effective  use  of  FTA.   For  example,  material 
factors  of  K.A.F.  are  shown  in  Table  VI.   What  was  the  basic 
event  of  flight  control  in  Table  VI?  Was  it  pitch,  yaw,  or 
roll  failure?   If  the  failure  was  due  to  yaw,  what  was  the 
basic  event  of  yaw?   Was  it  caused  by  wear,  shock,  or  vibra- 
tion?  The  fuel  system  can  be  included  as  a  subsystem  of 
thrust  control  and  also  must  be  divided  into  subsystems. 
Data  presented  in  Table  VI  is  inadequate  for  applying  FTA. 

Among  the  primary  factors  of  K.A.F.  data  pilot,  main- 
tenance, supervisory,  and  environmental  factors  are  human 
error.   Fault  tree  diagram  of  K.A.F.  accident  data  is  shown 
in  Appendix  B.   More  subsystems  and  basic  events  were  added 
to  illustrate  a  sample  aircraft  accident  fault  tree  and  develop 
the  methodology  for  collecting  and  applying  data.   A  method 
to  collect  data  will  be  described  below. 

1.   Data  Collection 

For  FTA,  the  data  is  not  confined  only  to  major  and 
minor  accidents.   Incident  and  Forced/Precautionary  Landing 
data  are  also  included,  i.e.,  accidents  are  sorted  into  cate- 
gories such  as: 

a.  Major  accident 

b.  Minor  accident 
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Table  VI 
Material  Factors  by  Year  of  Accident  (Major  &  Minor) 


^"^-^(ear 
Item  ^"^--.^,^^ 

70 

71 

72 

73 

74 

75 

76 

77 

78 

79 

Total 

Flight  Control 

1 

1 

Fuel  System 

1 

1 

1 

1 

1 

2 

7 

Turbine  Sect. 

1 

1 

Caiipxessor 
Section 

1 

1 

2 

4 

Ignition 
System 

1 

1 

Oil  Syst-jRm 

1 

1 

Elec.  Systi=ra 

1 

1 

T ending  Gear 

2 

1 

3 

Engine 

1 

1 

Propeller 
Unit 

1 

1 

Piston  Rod 

1 

1 

Flare  Misfire 

1 

1 

Flame  Out 

1 

1 

Fire 

1 

1 

1 

3 

Total, 

2 

4 

1 

7 

3 

6 

1 

1 

2 

27 

76 


c.  Incident. 

d.  Forced/precautionary  Landing. 

Basic  events  which  will  be  contributed  to  accidents 
in  these  subcategories  are: 

a.  Supervisory  factors. 

b.  Psychophysiological  factors. 

c.  Environmental  factors. 

d.  Material  failure. 

e.  Maintenance. 

Sample  format  of  supervisory  factors  is  shown  in 

Table  VII.   More  detailed  data  to  be  collected  is  presented 

in  Section  V. 

2 .   Development  of  an  Equation  for  Corrective  Action 
Recommendations 

This  section  concentrates  on  the  development  of  an 
equation  by  which  to  evaluate  cost  effectiveness  in  terms  of 
parameters  derived  from  the  fault  tree  analysis  and  parameters 
which  may  be  readily  estimated  from  the  data. 

The  cost  effectiveness  index  provides  a  measure  of 
dollars  saved  per  dollar  spent  in  implementing  recommenda- 
tions.  It  is  based  on  the  projected  percentage  improvement 
in  criticality  if  the  improvement  recommendation  is  implemented 
The  cost  effectiveness  index  is  the  ratio  of  cost  savings  to 
improvement  cost. 

CE   =   p^  (1) 

^I 

where : 
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CE   =   cost  effectiveness  index 
C^      =   cost  savings 

C^   =   improvement  cost 
The  cost  savings  may  be  expressed  in  terms  of  the 
difference  in  total  accident  cost  achieved  by  implementing 
the  improvement  recommendation.   This  may  be  expressed  as: 


=3   =   N<=A  -  '=Al'  <2> 


where : 


Cg   =   cost  savings 

N   =   number  of  accidents 

C,   =   cost  of  accident  without  improvement 

C  ^   =   cost  of  accident  with  improvement 

The  general  cost  of  a  single  accident  may  be  expressed  as 


C^   =   (CR) (C^)  I    a^  Y^  (3) 

i 


where : 


CR  =   criticality 


C„   =   cost  of  a  total  lost 

H 


a.   =  probability  of  an  accident  being  of  severity  i 
y.   =   relative  cost  of  an  accident  of  severity  i 
i   =   1  -  major  incident 
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i    =   2  -  minor  accident 

i    =   3  -  incident 

i   =   4  -  forced/precaution  landing 

This  equation  may  be  rationalized  in  terms  of  the 
criticality  representing  the  probability  of  an  accident  of 
any  severity  occurring  due  to  a  given  basic  fault.   The 
probability  of  the  accident  being  of  severity  i  is  then 
(CR)(a.).   The  cost  of  an  accident  of  severity  i  is  (C„)(y.) 

1  Hi 

The  cost  likely  to  be  incurred  due  to  accidents  of  all 
severities  is  the  sum  of  the  products  of  these  terms  as 
expressed  in  the  equation  above. 

The  criticality  after  implementation  of  the  improve- 
ment recommendation  may  be  expressed  as: 

CR'   =   (1-8)  (CR)  (4) 

where : 

3   =   percent  improvement  in  criticality 

The  cost  of  an  accident  after  implementation  of  the 
improvement  recommendation  may  then  be  expressed  as: 

C^^   =   (1-6)  (CR)  (Cjj)  I    a^Y^  (5) 

i 

By  substituting  equations  (3)  and  (5)  into  equation 
(2) ,    an  expression  for  cost  savings  is  obtained  in  terms  of 
parameters  which  have  known  numerical  values. 


80 


S   =   ^(^A  -  ^AI^ 


=   N{(CR)  (Cj^)I<:x^Yi  "  (1-3)  (CR)  {C^)la.y    } 
i  i  "^ 

=   N(CR)  (C„){1  -  (1-e)  l^a.Y- 
H  r  1  '  1 


Thus 


Cg   =   N6(CR)  (Cjj)j;a^Yi  ^^^ 

An  expression  for  the  cost  effectiveness  ratio  is 
obtained  by  substituting  equation  (6)  into  equation  (1) . 

C-      Ne(CR)(C„) 

Thus 

CE   =   Ne(CR)  ^  I    a.Y.  (7) 

^I  i 

In  order  to  apply  this  formula  we  have  to  set  up  a 
general  criteria  for  each  item. 

a.   Criticality  (CR) 

The  author  uses  the  definition  of  CR  suggested 

by  Birnbaum  (1975)  .   Let  g  be  a  function  that  computes  the 

probability  of  the  top  event  in  terms  of  the  basic  event 

probabilities.   To  generate  this  function  we  need  a  Boolean 

expression  for  the  top  event  in  terms  of  the  Boolean  variables 

of  the  basic  event.   The  outcome  of  each  basic  event  at  time 

t  has  an  indicator  variable  Y. (t) , 

1 
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Y^(t) 


1   when  basic  event  i  has  occurred  at  time  t 
0   otherwise 


If  the  state  of  each  basic  event  is  random,  the 
probability  that  event  i  occurs  by  time  t  can  be  defined  to 
be  F. (t) .   If  X. (t)dt  is  defined  to  be  the  probability  that 
event  i  occurs  between  t  and  t+dt,  given  that  event  i  has 
not  occurred  by  time  t,  then  F. (t)  can  be  expressed  in  terms 


of  A. (t) : 


t 
-    j    X.   (t)dt 


0    ^ 
F^(t)   =   1  -  e  ^ 


X.   (t)  is  commonly  referred  to  as  the  hazard  or  failure  rate 
at  time  t. 

If  we  construct  a  fault  tree  where  the  top  event 
is  system  failure  and  the  basic  events  are  component  failures, 
then  Birnbaum's  definition  of  component  importance  becomes 


8g{F(t) } 


=   g{l.  ,F(t)}  -g{0.  ,F(t)  } 


where  g{F (t) }  is  the  probability  that  the  top  event  occurs 
by  time  t.   The  above  expression  is  the  probability  that  the 
system  is  in  a  state  in  which  the  functioning  of  component 
i  is  critical:   the  system  functions  when  i  functions,  the 
system  fails  when  i  fails.   The  probability  that  the  system 
is  in  a  state  at  time  t  in  which  component  i  is  critical  and 
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that  component  i  has  failed  by  time  t  is  the  criticality  of 
the  ith  basic  event,  i.e.. 


CR   =   [g{l^,F(t) }  -  g{0^,F(t) }]F^(t) . 


Example 

Assume  that  the  fighter  aircraft  accident  data 
(including  incident  and  forced/precaution  landing)  of  the 
K.A.F.  was  collected  for  a  10  year  period  and  a  fault  tree 
diagram  was  constructed  the  same  as  in  Appendix  B.   From 
this  diagram,  the  number  of  basic  event  accidents  due  to 
insufficient  experience  is  3.   What  is  the  basic  event 
failure  probability,  head  event  probability  and  basic  event 
criticality? 

Before  solving  this  problem,  assume  the  following 
data  was  collected. 

Total  flight  time  of 

fighter  aircraft  606,100  hr 

Total  sorties  586,600 

Average  flight  time  1.033  hr 

Assuming  an  exponential  failure  distribution,  the  failure 
rate  is: 


'      =   6067100   =   4.95.10-Vhr 


Probability  of  basic  event  'limited  experience'  is 
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F^(t)       =      1    -   e"^^      =      At      =      4.95  xio"^  xi,033 
=      5.11  X lo"^ 


For   basic   event    'inadequate    training'. 


^      =      6067100      =      3.30xio-Vhr 
F^Ct)       =      At      =      3.30  X  lo"^  X  1.033 
=      3.41      lO"^ 


Then,    the   probability  of   flight   beyond   capability  P,.    is 


p^    =    1  -    n     (1  -  F  ) 

-L^  i=l  ^ 


1    -    (1  -5.1  X  lo"^)  (1  -  3.41  X  lo"^) 


8.52  X 10"^ 


In   the    same   way , 


P-,   =   Probability  of  faulty  flight  plan 
=   5.10  X lo"^ 


P,„   =  Probability  of  inadequate  W„  analysis 
=   3.40  X lo"^ 


P.  -.   =   Probability  of  poor  crew  coordination 
=   5.10  X lo"^ 
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P,r   =   Probability  of  inadequate  briefing 
=   5.11  X lo"^ 


21 


=  Probability  of  supervisory  error 


1  -  n  (1  -  p  ) 

i=l      ^^ 
1    -    (1  -5.10  X  lo""^)  (1  -  3.40  X  lo"^)  (1  -  5.10  X  10"^) 


(1  -8.52  xio"^)  (1  -5.11  X  lo"^) 


=   2.72  X 10 


-5 


If  we  collected  all  of  the  other  event  data  and 
the  probabilities  of  each  event  calculated  as  in  Table  VIII, 
then,  by  using  the  procedure  with  AND  or  OR  gate,  we  have: 

Table  VIII 
Failure  Probability 


EVENTS 

Failure  Probability 

Maintenance 

10.10  X lo"^ 

Environmental  Condition 

1.03  X 10"^ 

Psychophysiological 
Disturbance 

2.05  X lo"^ 

Flight  Control 

9.25  X 10"^ 

Thrust  Control 

8.55  X lo"^ 

Landing  Gear 

6.18  X 10~^ 

Unknown  Crash 

1.20  X 10"^ 

85 


Probability  of  pilot  error   =   5.80  x 10 

-5 
Probability  of  human  error   =   6.81  x 10 

-4 
Probability  of  material  failure   =   2.40  x 10 

-4 
Probability  of  head  event  failure   =   3.20  x 10 


Calculation  of  criticality: 

If  the  ith  component  'Insufficient  Experience' 
failed, 

g{l. ,F(t) }   =   3.20  X lo"^. 

If  the  ith  component  'Insufficient  Experience' 
didn't  fail  and  the  head  event  failure  occurred,  then 


Fj_(t)   =   At   =   0  X  1.033   =   0 


Thus 


2  -fi 

P     =   1  -   n  (l-F.)   =   1  -  (1-0)  (1  -3.41  X  10  ^) 
■L^  i=l      ^ 

=   3.41  X lo"^ 

P^-L   =   1  -  (1  -5.10  X  10"^)  (1  -  3.40  X  10"^)  (1  -5.11  X  10"^) 

•  (1  -5.10  X  10"^)  (1  -  3.41  X  10'^) 

=   2.21  X 10"^ 


Finally  we  get  the  probability  of  head  event  failure  as 

-4 
3.15  X 10   .   Thus, 
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CR   =   (3.20  X  lo""*  -  3.15  X  lo""^)  (5.11  X  10~^) 
=   2.56  X  lo"-'--^ 


b.   Number  of  Accidents  (N) 

An  estimate  of  the  number  of  accidents  in  the 
remaining  service  life  of  fighter  aircraft  in  the  K.A.F. 
would  be  calculated  if  we  knew  the  average  sorties  flown  per 
year  and  the  projected  remaining  life  of  operation.   Suppose 
the  average  sorties  flown  per  year  was  58  660  and  the  average 
operational  life  of  fighter  type  aircraft  was  8  years. 

From  the  fault  tree  it  was  determined  that  the 

probability  of  an  accident  of  any  type  of  basic  event  is 

-4 
3.20  X 10   .   Then  the  number  of  accidents  expected  to  occur 

in  the  remaining  operational  life  is: 


N   =   (58660)  (8)  (3.20  X  lo"^)   =   150 


Though  the  above  value  was  derived  by  estimate,  its  absolute 
value  is  unimportant  since  ranking  of  cost  effective  proce- 
dures id  based  on  a  relative  figure  of  merit. 

c.  Percent  Improvement  in  Criticality  (6). 

The  percent  improvement  achievable  by  implementing 
suggested  improvement  recommendations  for  the  particular  fault 
is  based  on  an  engineering  judgment. 

d.  Ratio  of  Total  Loss  to  Improvement  Cost  (p— 1 

^I 
Total  loss  is  equivalent  to  the  average  acquisi- 
tion cost  of  all  types  of  fighter  aircraft.   For  each 
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improvement  technique,  estimates  can  be  made  of  the  cost  to 
implement  the  improvement  as  a  fraction  of  the  acquisition 
cost,  C^/Cj^. 

e.   Relative  Cost  of  an  Accident  of  Severity  i  (y • ) 

The  relative  cost  associated  with  a  given  accident 
depends  on  its  severity.   Accident  costs  will  be  noimalized 
with  respect  to  the  average  of  the  manhours  required  to  com- 
plete repair  or  replacement  of  major  damage  for  all  kinds 
of  fighter  aircraft. 

Suppose  we  know  the  following  data. 

1.   Major  Damage  Classification 


Type  of  aircraft 

F-K 

F-M 

F-X 

F-Y 

F-Z 

Manhours 

500 

600 

700 

800 

900 

2.   Minor  Damage  Classification 


Type  of  aircraft 

F-K 

F-M 

F-X 

F-Y 

F-Z 

Manhours 

200 

180 

150 

120 

50 

Then  the  average  of  the  manhours  required  to  complete  repair 
or  replacement  of  major  damage  for  all  types  of  aircraft  is: 

(500  +  600  +  700  +  800  +  911)/5   =   700 

The  average  manhours  of  minor  damage  is  140,   The  relative 
cost  of  a  minor  accident  is  then  140/700  =  .2.   The  same  ratio 
can  be  applied  in  relating  an  incident  to  a  minor  accident 
and  a  forced/precaution  landing  to  an  incident.   Assume  the 
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relative  cost  of  incident  is  0.03  and  forced/precaution  landing 
is  0.004  for  calculation  of  COST  effectiveness  as  an  example. 

f.   Probability  of  an  Accident  Being  of  Severity  i  (a.) 

It  is  often  the  case  that  basic  events  have 
different  probabilities  of  inducing  accidents  of  varying 
severity,  i.e.,  some  event  will  always  result  in  a  major 
accident,  whereas  other  events  may  induce  a  major  accident, 
minor  accident,  incident,  or  forced  landing.   The  probabili- 
ties depend  on  other  interacting  elements  in  the  system. 
Therefore,  in  arriving  at  a  cost  effectiveness  index,  the 
criticality  of  a  basic  fault  must  be  weighed  to  reflect  its 
impact  on  accident  severity.   This  is  achieved  by  introducing 
a  factor  a.  into  the  expression  for  cost  savings  to  account 
for  the  probability  of  a  given  accident  severity.   The  evalua- 
tion of  this  parameter  requires  an  engineering  judgment  to 
be  made  of  the  probabilities  of  a  basic  fault  causing  acci- 
dents of  varying  severities. 
Sample  calculation  of  CE 

Assume  that  the  accident  occurred  from  limited 
experience  (Basic  event  1.8  of  Appendix  B)  ,   The  cause  of 
failure  was  due  to  "order  to  pilot  beyond  capability  on 
flight" .   The  corrective  action  recommended  is  an  establish- 
ment of  experience  criteria.   The  cost  effectiveness  of  this 
recommendation  is: 

From  collected  data  and  engineering  judgment, 
assume  we  have  g  =  70%,  a,  =  10%,  a      =  40%,  a-  =  40%,  a,  =  10% 
and  C_/C     =  0.1.   Then 

X   ri 
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C     4 
CE   =   N  (CR)  (p^)  I    ay. 
^1      i=l  ^  ^ 

=   150x0.7x(2.56x  lO"-^-^)  X  -i_  x  (0.1  x  l.O 

+  0.4x0.2  +  0.4x0.03  +  0.1x0.0004) 
=   5.17  X 10"^ 

The  relative  cost  effectiveness  is  obtained  by 
proportion  of  the  above  value  to  the  most  cost  effective 
item  in  the  list,  i.e.,  set  the  most  cost  effective  item  to 
be  1.0.   For  example,  suppose  supervisory  error  in  maintenance 
has  the  greatest  CE  value  of  65,  then  relative  cost  effec- 
tiveness of  3.5  in  Appendix  B  is  1  and  accident  due  to  limited 

-7  -11 

experience  is  5.17  xio   /65  =  7.9  xio    .   Example  cost  effec- 
tiveness ranking  is  shown  in  Table  IX.   We  can  decide  the 
basic  event  fault  is  not  critical  and  then  it  will  be  eliminated 
from  Table  IX  (e.g.,  if  CR  <  lO"-^^)  . 

FTA  was  suggested  as  a  method  of  system  safety 
analysis  which  can  improve  flight  safety  through  identifica- 
tion of  safety  critical  items  and  make  cost  effective  recom- 
mendations.  FTA  is  a  detailed  deductive  analysis  that  usually 
requires  considerable  system  information.   It  can  be  a  valua- 
ble design  tool.   FTA  can  also  be  a  diagnostic  tool  in  that 
it  can  predict  the  most  likely  causes  of  system  failure  in 
the  event  of  system  breakdown. 
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C.   CRITICAL  INCIDENT  TECHNIQUE  (CIT) 

The  CIT  consists  of  a  set  of  procedures  for  collecting 
direct  observations  of  human  behavior  in  such  a  way  as  to 
facilitate  their  potential  usefulness  in  solving  practical 
problems.   As  a  measure  for  accident  research,  it  reveals 
causal  factors  in  terms  of  human  errors  and  unsafe  conditions 
that  lead  to  aircraft  accidents  and  it  provides  more  infor- 
mation about  accident  causes  and  a  more  sensitive  measure  of 
total  accident  performance  than  other  available  methods  of 
accident  study. 

The  CIT  has  been  used  to  collect  both  accident  and  near 
accident  data  without  any  discrimination  being  made  between 
the  two  types  of  data.   However,  in  particular  cases  the 
investigator  may  confine  his  attention  to  one  or  the  other 
type  of  data. 

By  collection  and  categorization  of  common  errors  from 
human  factors  data  in  aircraft  operation,  possible  direction 
of  accident  prevention  and  recommendation  will  be  provided. 
For  example,  if  we  collect  data  of  specific  experiences  from 
pilots  in  taking-off,  flying  an  instrument,  landings,  using 
controls  and  using  instruments,  then  the  data  may  provide 
many  factual  incidents  that  can  be  used  as  a  basis  for 
planning  research  on  the  design  of  instruments,  controls, 
training,  and  the  arrangement  of  these  within  the  cockpit. 

To  be  useful  the  incidents  must  be  detailed  enough  a)  to 
allow  the  investigator  to  make  inferences  and  predictions 
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about  the  behavior  of  the  person  involved  and  b)  to  leave 
little  doubt  about  the  consequences  of  the  behavior  and  the 
effects  of  the  incident. 

The  two  primary  steps  included  in  the  critical  incident 
procedure  are : 

1 .   Collection  of  the  Data 

The  most  important  item  for  accident  research  is  the 
real  data  in  detail.   The  CIT  is  frequently  used  to  collect 
data  on  observations  previously  made.   This  is  usually  satis- 
factory when  the  incidents  reported  are  fairly  recent  and  the 
observers  were  motivated  to  make  detailed  observations  and 
evaluations  at  the  time  the  incident  occurred. 

The  practical  problem  in  collecting  the  data  for  des- 
cribing an  activity  refers  to  the  problem  of  how  it  should 
be  obtained  from  the  observers.   This  applies  especially  to 
the  problem  of  collecting  recalled  data  in  the  form  of 
critical  incidents.   Three  procedures  for  collecting  data 
are  described  below. 

a.   Interviews 

The  use  of  trained  personnel  to  explain  to  observers 
precisely  what  data  are  desired  and  to  record  the  incidents, 
making  sure  that  all  necessary  details  are  supplied,  is 
probably  the  most  satisfactory  data  collection  procedure. 
This  type  of  interview  is  somewhat  different  from  the  other 
types  of  interview  and  a  brief  summary  of  the  principle  mis- 
hap factors  involved  will  be  given. 
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b.  Questionnaires 

If  the  group  becomes  large,  a  questionnaire  pro- 
cedure is  convenient. 

c.  Record  Forms 

One  other  procedure  for  collecting  data  is  by 
means  of  written  records.   There  are  two  varieties  of  recording 
one  is  to  record  details  of  incidents  as  they  happen.   This 
situation  is  very  similar  to  that  described  in  connection  with 
obtaining  incidents  by  interviews  above. 

A  variation  of  this  procedure  is  to  record  such 
incidents  on  forms  which  describe  most  of  the  possible  types 
of  incidents  by  placing  a  check  or  tally  in  the  appropriate 
place . 

As  additional  information  becomes  available  on 
the  nature  of  the  components  which  make  up  activities,  obser- 
vers may  thus  collect  data  more  efficiently  by  using  forms 
for  recording  and  classifying  observations. 
2 .   Analyzing  the  Data 

The  collected  data  of  a  large  sample  of  incidents 
provides  a  functional  description  of  the  activity  in  terms 
of  specific  behaviors.   The  purpose  of  the  data  analysis  stage 
is  to  summarize  and  describe  the  data  in  an  efficient  manner 
so  that  it  can  be  used  effectively. 

For  analyzing  the  data  we  have  to  consider  two  pri- 
mary problems  involved.   These  problems  will  be  discussed 
below. 
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a.  Frame  of  Reference 

There  are  countless  ways  in  which  a  given  set 
of  incidents  can  be  classified.   In  selecting  the  general 
nature  of  the  classification,  the  principle  consideration 
should  usually  be  that  of  the  uses  to  be  made  of  the  data. 
The  preferred  categories  will  be  those  believed  to  be  most 
valuable  in  using  the  statement  of  requirements.   Other  con- 
siderations are  ease  and  accuracy  of  classifying  the  data. 

b.  Category  Formulation 

The  induction  of  categories  from  the  basic  data 
in  the  form  of  incidents  is  a  task  requiring  insight,  experi- 
ence, and  judgment.   The  usual  procedure  is  to  sort  a  rela- 
tively small  sample  of  incidents  into  piles  that  are  related 
to  the  frame  of  reference  selected.   After  these  tentative 
categories  have  been  established,  brief  definitions  of  them 
are  made,  and  additional  incidents  are  classified  into  them. 
During  this  process,  needs  for  redefinition  and  for  the 
development  of  new  categories  are  noted.   The  tentative  cate- 
gories are  modified  as  indicated  and  the  process  continued 
until  the  incidents  have  been  classified.   The  larger  cate- 
gories are  subdivided  into  smaller  groups  and  the  incidents 
that  describe  very  nearly  the  same  type  of  behavior  are  placed 
together.   The  definition  for  all  the  categories  and  major 
headings  should  then  be  re-examined  in  terms  of  the  actual 
incidents  classified  under  each. 

A  major  problem  area  in  CIT  involves  actual  data 
collection.   The  following  items  will  be  applicable  to  interview 
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or  record  form  in  order  to  collect  human  factors  data  in 
aircraft  operation. 

1.   Description  of  the  occurrence 

a.  Aircraft 

(1)  Model 

(2)  Configuration  when  anomaly  occurred  (gear, 
flaps,  thrust,  fuel,  quantity,  etc.) 

b.  Type  of  operation 

c .  Time  and  location 

(1)  Local  time 

(2)  Elapsed  time  since  departure  from  parking 
area 

(3)  Phase  of  flight 

(4)  Geographic  location 

d.  Nature  of  the  anomaly  (describe  the  deviation  from 
normal  or  expected  performance  as  precisely  as 
possible) 

e.  Radio  navigation  facilities  in  use  and  type  of 
navigation 

f.  Detection  of  the  anomaly  (Identify  the  person 
responsible  for  each  pertinent  decision,  command, 
action,  communication  or  interaction  with  others) 

(1)  Who  first  noticed  the  deviation?   (Aircraft 
commander,  air  traffic  controller,  maintenance 
personnel,  or  others  (explain)).   Who  should 
have? 

(2)  What  brought  it  to  his  attention?   What  should 
have? 

g.  Cockpit  environment  preceding  the  anomaly. 

(1)  Was  there  anything  unusual  about  the  operation? 

(2)  Were  there  any  distractions  immediately  before 
the  anomaly  occurred? 

(3)  What  was  the  weather  at  the  time  of  the 
occurrence? 

h.   What  actions  immediately  preceded  the  anomaly,  in 
order  of  occurrence? 

(1)  Did  any  of  these  actions  contribute  to  the 
anomaly? 

(2)  What  decisions  motivated  this  action?   Who  made 
them? 
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(3)   What  information  was  the  basis  for  the  deci- 
sions?  Was  the  information  correct? 

i.   Was  there  any  indication  before  the  anomaly  that 
it  was  going  to  occur  or  might  occur?   If  so: 

(1)  What  was  the  indication? 

(2)  Who  noticed  it? 

(3)  Was  it  noticed  immediately?   If  not,  why  not? 
Recovery  following  the  occurrence 

a.  What  happened  after  the  anomaly  occurred? 

(1)  What  decisions  were  made? 

(2)  By  whom? 

(3)  For  what  reasons? 

b.  What  actions  were  taken  to  correct  the  deviation? 

(1)   By  whom  was  each  action  initiated?   When?   Why? 

c.  What  effect  did  each  action  have? 

(1)  Did  it  help  recovery? 

(2)  Did  it  hinder  recovery? 

d.  Did  any  complicating  factors  arise  during  the 
recovery  period?   (After  the  initial  deviation, 
other  events  can  occur  while  the  crew  is  recovering 
from  the  first  one.   Be  careful  to  identify  these.) 

e.  Was  normal  operation  restored?   How  long  did  it  take? 

f.  Was  safety  threatened  at  any  time? 

(1)  If  so,  what  was  the  nature  of  the  threat? 

(2)  Was  it  recognized  at  the  time? 

(3)  Who  recognized  it? 

(4)  How  was  it  recognized? 

(5)  How  long  did  it  last? 

(6)  What  was  done  to  control  or  minimize  the 
threat? 

(7)  Could  the  threat  have  been  controlled  more 
effectively? 

Background 

a.   If  pertinent,  describe  the  history  of  the  personnel 
involved  and  of  the  airplane  and  facilities  utilized 
in  this  flight. 

(1)  Nutrition  and  rest:   Describe  meals  as  to  time 
eaten  and  type  of  food  and  sleeping  time . 

(2)  Were  there  any  medical  or  physiological  problems? 
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(3)  Describe  the  crew's  rest  and  duty  schedule 
for  this  flight  sequence.  Was  this  flight 
their  scheduled  activity? 

a)  Do  the  pilots  believe  the  duty  or  rest 
schedule  was  a  factor? 

b)  Describe  their  activities  during  the 
preceding  day. 

(4)  Were  there  any  problems  within  the  flight 
crew  with  respect  to  discipline,  coordination, 
ability,  personality  factors? 

(5)  Were  there  any  other  problems  (ground  support 
personnel,  controller,  management,  others)? 

(6)  Were  any  other  factors  pertinent  during  the 
period  prior  to  flight? 

b.   Describe  in  brief  the  history  of  this  flight  prior 

to  the  occurrence.   Emphasize  any  decisions,  actions, 
events  or  omissions  which  might  have  been  related 
to  the  later  anomaly. 

(1)  Was  servicing  and  ground  support  normal? 

(2)  Were  there  any  supervisory  problems? 

(3)  Were  there  any  ground  or  flight  delays? 

(4)  Were  there  any  problems  at  the  departure 
airport? 

(5)  Were  there  any  air  traffic  control  or  airways 
facilities  problems? 

(6)  Was  weather  a  problem  at  any  time?   If  so,  how? 
Analysis  and  recommendations 

This  section  should  contain  only  the  opinions  and 
recommendations  of  the  person  reporting  the  occurrence. 

a.  Was  the  situation  evaluated  correctly  when  the 
anomaly  was  detected? 

(1)  If  so,  were  any  special  factors  responsible? 

(2)  If  not,  why  was  the  evaluation  incorrect? 

(3)  Could  anything  have  improved  the  accuracy  of 
the  evaluation? 

b.  Was  the  detection  of  the  anomaly  as  prompt  as  it 
should  have  been? 

(1)  If  so,  were  any  special  factors  responsible? 

(2)  If  not,  why  was  there  a  delay  in  detection? 

(3)  Could  anything  have  improved  the  speed  of 
detection? 
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c.  Was  the  recovery  from  the  deviation  the  most 
effective? 

d.  Was  there  any  problem  in  flight  crew  management  or 
coordination?  Describe  any  deficiencies,  problems 
or  comments  in  detail. 

e.  Was  the  entire  flight  managed  professionally  and 
effectively? 

(1)   If  not/  what  might  have  been  done  better? 

f.  Was  Air  Traffic  Control  involved  in  any  way? 

(1)  If  so,  was  the  problem  due  to  ATC  handling  or 
instructions? 

(2)  If  so,  was  there  any  flight  crew  misunder- 
standing of  ATC  handling  or  instructions? 

(3)  Did  ATC  do  anything  to  minimize  the  problem? 

g.  Was  any  airplane  system  involved? 

(1)   Did  maintenance  contribute  to  the  problem? 
h.   Was  this  a  fairly  common  problem? 
i.   Was  pilot  training  adequate: 

(1)  To  have  prevented  this  occurrence? 

(2)  To  correct  or  control  it  under  these 
circumstances? 

(3)  To  cope  with  it  under  all  circumstances? 

j .   Were  any  of  the  following  involved  in  any  way? 
If  so,  how? 

(1)  Flight  crew  supervision? 

(2)  Flight  dispatch? 

(3)  Flight  or  ground  support? 

(4)  Other? 

Supplement  (for  interviewer  only) 

a.  Was  the  reporting  person's  memory  entirely  clear 
as  to  the  details  of  this  occurrence?   If  not,  in 
what  areas  did  he  have  difficulty  remembering 
details? 

b.  In  your  opinion,  did  this  incident  pose  a  threat 
to  flight  safety?   If  so,  how  and  why? 

c.  Add  any  additional  comments  or  opinions  you  may 
have  as  to  the  factors  involved  in  this  occurrence 
and  as  to  measures  which  might  prevent  such  problems 
in  the  future . 
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After  collecting  the  data  by  the  methods  given 
above,  we  can  analyze  the  data.   The  sample  size  must  be  as 
large  as  possible  for  categorization.   Table  X  is  the  classi- 
fication of  pilot-error  experiences  as  a  result  of  analyzing 
the  data.   This  is  just  an  example  to  show  how  to  analyze 
the  data. 

In  summary,  the  CIT  is  used  as  a  method  of  dis- 
covering and  attempting  to  reduce  or  control  hazardous  situa- 
tions before  accidents  occur. 

In  effect,  the  CIT  accomplishes  the  same  end 
result  as  an  accident  investigation:   identification  through 
personal  involvement  of  a  hazard  that  has  or  could  result 
in  injury  or  damage.   The  CIT  has  been  used  in  evaluation  of 
pilot  safety  and  has  proven  beneficial  as  a  qualitative 
safety  technique. 

D.   OTHER  STATISTICAL  METHODS 

In  general,  accidents  are  not  single  causation  events, 
rather  multivariate  factors.   So  we  can  use  many  kinds  of 
statistical  methods  to  analyze  the  data.   Multiple  regression 
analysis  and  cluster  analysis  are  widely  used.   Different 
statistical  methods  can  be  applied  to  the  collected  data. 

The  following  is  an  example  of  the  use  of  statistical 
methods.   Suppose  it  is  important  to  determine  if  there  is 
a  statistically  significant  difference  between  the  pilot 
factor  accident  rates  of  experienced  and  inexperienced  pilots 
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Table  X 
Example  Classification  of  Pilot  Error  Experiences 


Type  of  Error 

Number  of 
Errors 

1 

Errors  in  interpreting  multi-revoluticn  instruments 

a.  Errors  involving  an  instrument  which  has  more 
than  one  pointer  (e.g.,  misreading  the  altimeter) 

b.  Errors  involving  an  instrument  which  has  a 
pointer  and  a  rotating  dial  viewed  through 
a  window  (e.g.,  misreading  the  tachometer, 
air-speed  indicator) 

2 

Substitution  errors 

a.  Mistaking  one   instrument  for  another 

b.  Confusing  which  engine  is  referred  to  by  an 
instrument 

c.  Difficulty  in  locating  an  instrument  because 
of  unfamiliar  arrangement  of  instinjments 

3 

Reversal  errors  (e.g.,  reversals  in  interpreting 
the  direction  of  bank  shown  in  attitude  indicator, 
reversals  in  interpreting  direction  frcm  oonpasses) 

4 

Errors  due  to  illusions:  Faulty  interpretaticn  of 
the  position  of  an  aircraft  because  body  sensaticns 
do  not  agree  with  what  the  instruments  shew 

5 

Using  an  instrument  that  is  inoperative 

6 

Signal  interpretaticn  errors:  Failure  to  notice 
a  warning  light  in  the  ai.rcraft,  or  confusing 
one  warning  light  with  another 
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(in  this  case,  the  "experience"  and  "inexperience"  would  have 
to  be  defined) .   Choose  some  time  frame  and  let 

h,   =  number  of  flight  hours  flown  by  experienced 
pilots 

h-   =  number  of  flight  hours  flown  by  inexperienced 
pilots 

a,   =  number  of  pilot  factor  accidents  involving 
experienced  pilots 

a^   =   number  of  pilot  factor  accidents  involving 
inexperienced  pilots. 

Then  the  rates  for  experienced  and  inexperienced  pilots  are 

(a  xioo,000)/h,  and  (a  x  100 ,  000) /h  ,  respectively.   We 

want  to  test  the  null  hypothesis: 

H-:   There  is  no  difference  in  accident  potential 
between  experienced  and  inexperienced  pilots 

Testing  H^  amounts  to  testing  a  hypothesis  about  the  success 
probability  in  a  binomial  distribution.   Let  a  and  h  be  the 
number  of  accidents  and  time,  respectively,  for  the  group 
with  the  larger  accident  rate  (e.g.,  a  =  a,  and  h  =  h, ,  if 
the  experienced  pilots  had  the  higher  rate). 
Let 


P  =  ^-TE^  '  P  =  h^Th^  '    n  =  a^^  +  a^. 

We  will  reject  H_  if  p  and  p  differ  too  much.   Compute 
T  =  P(X>_a),  where  X  has  a  binomial  distribution  with 
parameters  n  and  p.   Thus, 
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n       ,     . 

T  =    )  -r-n ^T  P  (1  ~P) 

. ^  1 ! (n-i) I  ^     ^ 
i=a 


Let  a  be  the  significance  level  of  the  test  (e.g.,  a  =  0.05)  . 
If  T  >  a/2,  then  accept  Hp..   That  is,  we  would  conclude  that 
there  is  not  sufficient  evidence  based  on  this  data,  to  say 
there  is  a  difference  between  experienced  and  inexperienced 
pilots.   If  T  <_  a/2,  then  reject  H^  and  conclude  (at  signifi- 
cance level  a)  that  there  is  a  difference  between  experienced 
and  inexperienced  pilots. 

The  above  test  is  an  example  of  a  two-sided  test.   It  is 
designed  to  answer  the  question,  "Is  there  a  difference 
between  experienced  and  inexperienced  pilots?"   A  one-sided 
test  could  be  done  to  answer  the  question,  "Are  experienced 
pilots  safer?"   The  null  hypothesis  in  this  case  would  be: 


H- :   experienced  pilots  are  not  safer  than 
inexperienced  pilots 


For  this  case,  let  a  =  a,  and  h  =  h, ,  and  compute  T,  p,  p, 
and  n  according  to  the  same  formulas  as  before.   We  will 
reject  H_  if  p  is  much  larger  than  p.   If  T  >  a,  we  accept 
H-..   That  is,  we  conclude  that  there  is  not  sufficient  evi- 
dence, based  on  this  data,  to  say  that  experienced  pilots 
are  safer  (with  significance  level  a)  .   If  T  <_  a,  then  re- 
ject H-  and  conclude  (at  significance  level  a)  that  experi- 
enced pilots  are  safer. 
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V.   CONCLUSIONS/RECOMMENDATIONS 

Aircraft  accidents  are  rarely  caused  by  a  single  factor. 
Generally,  accidents  are  the  end  result  of  system  deficien- 
cies, human  error  and  design  deficiencies  coming  together 
simultaneously.   The  most  commonly  designated  cause  of  acci- 
dents is  human  error.   For  flight  safety,  a  systematic  acci- 
dent prevention  program  should  include  consideration  of  all 
possible  sources.   Accident  prevention  is  best  pursued  within 
the  framework  of  this  program.   There  are  certain  fundamental 
concepts  and  methods  which,  if  properly  applied,  can  increase 
the  probability  of  success  in  the  determination  of  factors 
contributing  to  an  accident.   Several  methodologies  for  the 
measurement  of  flight  safety  and  data  collection  have  been 
proposed  in  this  thesis  for  inclusion  in  the  K.A.F.  safety 
program. 

The  primary  goal  of  accident  prevention  progam  is  to 

prevent  mishaps.   Therefore,  the  K.A.F.  needs  to  develop 

a  safety  program  based  on  the  following  data  collection  and 

analysis  methods: 

1.   Develop  a  format  which  will  describe  each  element 

(e.g.,  pilot,  maintenance,  supervisory  error,  material 
failure)  in  detail.   For  example  the  U.S.A.F.  has 
developed  a  system  for  accident  data  collection  (see 
Appendix  C)  which  provides  for  a  comprehensive  con- 
sideration of  variables  involved  in  flight  safety. 
The  following  elements  are  contained  in  the  U.S.A.F. 
data  collection  system: 

a.  Ground  mishap  report. 

b.  Aircraft  flight  mishap  report. 
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c.  Aircraft  maintenance  and  material  report. 

d.  Life  sciences  report  of  an  individual. 

e.  Psychophysiological  and  environmental  factors. 

f.  Personal  data. 

2.  K.A.F.  needs  to  consider  the  application  of  the 
critical  incident  technique  (CIT)  as  described  in 
Section  IV  to  collect  and  analyze  data.   CIT  is 
used  in  evaluation  of  flight  safety  and  as  a 
qualitative  safety  technique. 

3.  Use  the  format  of  system  safety  hazard  analysis  (SSHA) 
for  fault  tree  analysis.   In  system  safety  analysis, 
the  results  of  SSHA  should  be  used  to  determine  what 
safety  requirements  are  needed  to  minimize  and  con- 
trol hazards  to  an  acceptable  level.   The  SSHA  should 
be  accomplished  by  a  systematic  evaluation  of  each 
subsystem  /component  to  determine  how  much  each 
element/subsystem  could  potentially  contribute  to 

a  specific  hazard.   A  sample  format  of  SSHA  reporting 
is  shown  in  Appendix  D. 

4.  Finally,  the  following  fundamental  data  should  be 
filed  in  the  computer  for  use  in  a  safety  analysis 
and  program  evaluation. 

Group  data 

(1)  Total  number  of  pilots  engaged  in  flying  by 
month  and  year. 

(2)  Flight  time  of  Command,  Wing,  and  Squadron  in 
month  and  year  by  model. 

(3)  Total  number  of  accidents  in  month  and  year  by 
Command,  Wing,  and  Squadron. 


Pilot 


Biographical  data 

( 1 )  Name 

(2)  Rank 

(3)  Date  of  birth 

(4)  Date  of  graduation  from  undergraduate 
flight  training 

(5)  Wing  and  Squadron  assigned 

(6)  Total  flight  time 

(7)  Total  jet  time,  conventional  aircraft  time, 
helicopter  time 
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(8)  Total  instructor  time 

(9)  Total  weather/instrument  time 

(10)   Number  and  type  of  accidents  the  individual 
has  had. 

b.   Accident  data 

(1)  Name  of  personnel  involved 

(2)  Date  of  occurrence 

(3)  Type  of  mission 

(4)  Phase  of  mission 

(5)  Duration  of  flight 

(6)  Type  of  accident 

(7)  Prime  and  contributing  factor 

(8)  Days  since  last  flight 

(9)  Hours  flown  in  last  24  and  4  8  hours 

(10)  Sorties  flown  in  last  24  and  4  8  hours 

(11)  Hours  flown  in  last  7,  30,  60,  and  90  days 

(12)  Total  time  in  this  aircraft  type 

In  addition,  similar  data  should  be  collected  on  main- 
tainers ,  supervisors,  air  traffic  controllers,  etc. 
Aircraft 

(1)  Model 

(2)  Total  flight  time 

(3)  Date  of  last  major  inspection 

(4)  Flight  time  since  last  major  inspection 

Accident  research  is  a  systematic,  empirical,  and  critical 
investigation  of  associated  factors  and  their  relationships 
in  an  accident.   For  this  research,  reliable  and  valid  acci- 
dent data  are  necessary.   If  the  data  are  collected  in  detail 
and  correctly  by  the  formats  and  techniques  proposed,  it  will 
provide  a  convenient  method  for  a  researcher  to  use  in  the 
development  and  application  of  a  safety  program.   For  example. 
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the  analysis  of  the  variables  or  causal  factors  of  aircraft 
accident  such  as  human  error,  material  failure  or  malfunc- 
tion, and  adverse  influences  of  the  environment  on  man  and 
machine  will  allow  the  researcher  to  develop  an  analytical 
model  for  a  specific  mishap.   There  are  several  multi- 
variate statistical  techniques  (e.g.,  factor  and  component 
analysis,  cluster  analysis,  regression  analysis,  etc.)  to 
analyze  the  accident  data.   These  techniques  can  be  used  to 
determine  significant  interrelationships  and  to  correct  sys- 
tem inadequacies  (i.e.,  what  caused  or  allowed  the  accident 
to  happen).   Also,  remedial  actions  (i.e.,  what  can  be  done 
to  preclude  the  occurrence  of  an  accident)  will  be  proposed. 
Finally,  application  of  the  findings  and  recommendations 
are  needed.   Qualified  investigators,  researchers,  and  safety 
officers  are  necessary  at  each  level  of  organization  (Figure 
21)  and  a  feedback  system  should  exist  between  and  within 
each  level.   If  a  mishap  occurs  (here  mishap  includes  major, 
minor  accident,  incident,  and  near  miss),  it  has  to  be  inves- 
tigated and  reported  by  a  reporting  system  to  Air  Force  Head- 
quarters Safety  Section  through  the  Command.   In  the  H.Q. 
Safety  Section  the  data  must  be  encoded,  analyzed,  and  recommen- 
dations made  known  by  the  dissemination  of  mishap  results 
and  findings  should  be  passed  to  Wing  and  Squadron  through 
the  Command.   The  Squadron  must  then  take  action  on  this 
recommendation.   The  recommendations  including  general  trends 
of  mishap  components  must  be  passed  monthly  to  Wing  and  Squadron 
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Figure  21.   Proposed  Information  Flow  for  R.O.K. 
Safety  Program 
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Appendix  E  is  a  sample  trend  chart  developed  by  the  U.S.A.F, 
and  applicable  to  the  K.A.F. 

The  safety  program  described  in  this  thesis  possesses 
the  potential  for  reducing  overall  operational  costs  and 
maximizing  aircraft  availability.   The  end  result  of  such  a 
program  can  only  serve  to  increase  operational  readiness 
and  thereby  maximize  overall  efficiency  and  military  capa- 
bility of  the  K.A.F. 
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APPENDIX   A 


BOOLEAN  LOGIC  AND  ITS  APPLICATIONS 

Boolean  algebra  was  developed  onqinallv  for  the  study  of  svrribolic  logic.  Its  rule?  and  expressions  m  mathematiral  symbols 
permit  complicated  prooosif'ons  to  be  clarified  and  simplified.  Boolean  algebra  is  especially  useful  wfierp  conrlitions  can  bf 
expressed  m  no  more  than  tv/o  values,  such  as  yes  or  no,  true  or  false,  on  or  off,  up  or  down,  go  or  no  go    It  has  (ound  wkW' 
application  m  areas  other  than  symbolic  logic.  For  example,  it  i$  used  extensively  in  the  design  of  computers  and  other 
electromechanical  assemblies  incorporating  large  numbers  of  onoff  (switching)  circuits.  Other  uses  are  m  probability  analysis. 
studies  involving  decision  making,  and  more  recently,  in  safety  and  fluidics.  The  chief  difference  between  the  various  disciplines 
in  their  employment  of  Boolean  algebra  is  in  notation  and  symbology.  Since  the  information  in  this  section  presents  basic 
elements  only,  expressions  most  commonly  found  in  safety  analyses  will  be  used 

A  sjt. is  a  group  of  objects  having  at  least  one  characteristic  in  common.  The  set  may  be  a  collection  of  ob|Pcts.  conditions. 
events,  symbols,  ideas,  or  mathematical  relationships.  The  unity  of  a  set  can  be  expressed  by  the  number  1,  and  an  empty 
set,  which  contains  none  of  these,  by  0   The  numerals  1  and  0  are  not  quantitative  values:  1  *■  1  does  not  equal  2    They  am 
merely  symbols.  There  are  no  values  between  the  two  as  there  are  in  probability  calculations.  Set  relationships  are  sometimes 
illustrated  by  Venn  diagrams.  The  following  rectangle  represents  a  set  of  elements  that  have  an  undefined  common  chararterisuc. 
In  addition,  a  subset  has  the  cfiaract eristic  A.  All  other  elements  in  the  set  do  not  have  the  A  characteristic  and  are  cnnsidrred 
being  "not  A,"  designated  by  A,  A  is  the  complement  of  A,  and  vice  versa.  It  can  be  seen  that  the  total  of  A  and  A  is  the  lomplete 
set,  expressed  mathematically  by  A  +  A  =  1 ,  where  the  left  side  of  the  equation  is  the  union  of  A  and  A    The  ♦■  sign  is  read 
"OR",  and  may  be  designated  in  mathematical  expressions  by  other  symbols,  such  as  U. 


(:© 


GD 


The  second  diagram  illustrates  the  concept  of  disjoint,  or  mutually  exclusive,  sets.  The  elements  of  one  subset  arp  not  mriud^d  m 
the  others,  and  therefore  are  not  interrelated  (other  than  being  in  the  same  set)    In  this  case,  however,  because  A,  B   and  C 
contain  all  the  elements  m  the  overall  set.  they  are  said  to  be  mutually  exclusive  and  exhaustive    A  +  B  +  C  ^  1 

The  third  diagram  indicates  that  some  elements  of  A  also  have  B  characteristics    These  are  indicated  hy  A8,  A     B  or  A'    B, 
called  the  intersection  of  A  and  B    The  intersection  contains  all  the  elements  with  the  characteristics  of  both  A  and  B   Whpn 
all  elements  with  the  characteristic  A  are  counted,  those  m  AB  will  also  be  counted.  The  remaining  diagrams  m  the  ■^ow  iMtistrate 
some  of  the  relationships  between  union,  intersection,  and  complement    Numerous  other  relationships  that  ran  bf>  "mploved 
in  mathematical  expressions  have  been  developed,  some  of  them  having  been  designed  as  laws.  These  are  listed  below,  with  some 
explanations  on  their  meaning  in  Boolean  logic. 


RELATIONSHIP 
A  •  1  -  A 

A    0  -  0 

A  *  0  =  A 

A  +  1  =  1 
A  -  A 
A  A  -  0 

A  *-  A  '  1 

A  A   -  A 
A  +  A  =  A 
A  B      8  A 


LAW 

Full  and  Empty  Sets 


Involution  Law 
Complementary  Relations 


Idempotent  Laws 


Commutative  Laws 


EXPLANATION 

The  only  portion  within  1  that  is  both  1  and  A  is 
that  within  A  itself. 

An  impossible  condition:  if  it  is  within  the  set.  it 
cannot  be  outside  the  set 

The  element  m  a  Subset  plus  anything  outsidp  the  snt 
w.il  have  only  the  characteristics  of  the  sub'Ji't 

The  whole,  exi^ressed  by  1 .  rannot  be  ''■»cee'l"<l 

The  comnlemp'lt  of  the  comitiprnf-nl  IS  tbn  id'm  itsplf 

An  impossibility,  a  condition  cannot  he  hnlh  A  .ind  A 
at  the  same  time. 

Those  elements  with  a  specific  charartpnstir  -md 
those  without  It  constitute  the  total  <;pf 

An  identity 

Also  an  identity 

The  plempnts  having  fjoth  cfiar.irfpristirs  havr  ih"ni 
no  matter  ilie  order  in  whicfi  exprrssrd 
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RtLATIOMSHIP  LAW  EXPLANATION 

A'   B      B»A  The  total  o(  those  elements  li<)vii'i)  iiii- I  h. II, Kt'T  I -III 

A  or  B  will  !)e  the  saine  no  nuiit-i  it,p  dkIi't  'ii 
which  they  are  expresseij 

A(B  C)  -  (A  B)C  Associative  Laws  The  elements  having  all  the  chatac  it;iisiK,s  A.  B  jnl 

C  will  have  them  no  matter  the  ()r(ler  in  wtiM  t\  rxprcssi'd 

A  t  (B  *  C)  =  (A  +  Bl  t-  C  The  total  of  all  the  elements  in  any  '.ubseis  will  be 

the  same  no  matter  the  order  in  wtiich  expresst'd 

A(B  *  C)  =  (A  B)  +  (AC)  Distributive  Laws  The  union  ot  one  suljset  with  two  oUiers  can  alsn  In' 

expressed  as  the  union  of  their  intei  st^ctions 

A  ♦  (B  C)  =  (A  *■  B)  (A  +  C)  The  union  of  one  subset  with  the  intersection  ot  kvo 

others  can  also  be  expressed  by  the  intersection 
of  the  unions  of  the  common  subset  with  the  other 
two. 

A(A  +  Bl  =  A  Absorption  Laws  A(A  +  B)  =  AA  <•  AB  =  A  <■  AB  sincf  AA  ^  A. 

A  +  AB  =  Ad  +  B)  =  A  since  B  is  included  m  1 

A  *■  (A  B)  =  A  A  ••■  (AB)  =  A  +  AB  -  Ad  ^■  B)  -  A 

AS    =  A  ♦  3  Ouallzation  The  complement  of  an  intersection  is  the  union  of  the 

(de  Morgan's)  Laws  individual  complements. 


A  +  8   -  AB  The  complement  of  the  union  is  the  intersection  of  the 

complements. 

Other  useful  identities  are  frequently  used  for  simplification  of  complex  Boolean  equations    Four  of  these  are: 

Identity  Derivation 

A  +  AB  =  A  +  B  Using  the  Distributive  Law;  (A  +  A)     (A  +  B)  -  A  *-  B 

A(A  +  B)  =  AB  Using  the  Distributive  Law:  A    A  +  AB  =  AB 

(A  +  B)  (A  +  C)  •  (A  +  C)  =  AC  <■  BC  Expanding  the  last  two  terms_(A  +  8)  (AA  +  AC  *  AC  +  CO.  CC  =■  C, 

AA  =  0,  AC  +  AC  =  C(A  +  A)  =  Cd )  =  C,  and  C  ♦■  C  =  C, 
remainder  is  (A  +  B)C,  or  AC  +  BC. 

AB  +  AC  +  BC  =  AB  +  AC  This  can  be  simplified  by  adding  ajerm  such  as  A  ■■  A   The  It^tt 

hand  side  then  becomes;  AB  *  AC  +  BC(A  +  A|  =  AB  11  *■  C)  ^ 
ACd  +  B)  =  AB  +  AC. 

GATE  (CONNECTIVE)        SYMBOL  EXPLANATION  TRUT.H  TABLE 

The  OR  connective  indicates  that  when  one  or 
more  of  the  inputs  or  governing  conrlitions  is 
present,  the  statement  will  be  true  or  an  output 
0^  (  \  will  result.  Conversely,  the  statement  will  be  false 

if,  and  only  if,  none  of  the  governing  conditions 
is  present. 


The  AND  connective  indicates  that  all  of  the 
governing  conditions  or^nputs  must  be  present 
AND  I  I  for  a  statement  to  be  true   If  one  of  the  conditions 

I       I  or  inputs  IS  missing,  the  statement  is  false 


A  +  B 

The  NOR  connective  may  be  considered  a   'not  OR" 
state   It  indicates  that  when  one  or  more  of  the 
inputs  IS  present,  the  statement  will  be  false  or  no 
"  (  I  output  will  result.  When  none  of  the  inputs,  neither 

A  nor  B.  IS  present,  an  output  will  result. 


A 

*  B 

OR 

0 

0 

0 

(Palsp) 

0 

1 

1 

(TriiP) 

1 
1 

0 

1 

! 
1 

iTriip) 
(Trup) 

A 

B 

ANIJ 

0 

0 

0 

(Faisp) 

0 

1 

0 

IFfllse) 

1 
1 

0 

1 

0 

1 

(False) 
(Trup) 

A 

^  B 

NOR 

0 

0 

1 

(True) 

0 

1 

0 

(False) 

1 

0 

0 

(False) 

1 

1 

0 

'False) 

The  NAND  connective  indicates  that  when  aM  of  the 
inputs  or  governing  conditions  or  inputs  are  ngi 
present,  the  statement  will  be  true  or  there  will  be 
NAND  I  I  an  output   When  all  of  the  inputs  or  governing 

conditions  are  present,  the  statement  will  be  false 
or  there  will  be  no  output. 


Ill 


A 

B 
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0 

0 
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APPENDIX    B 
FAULT    TPvEE    DIAGRAM   FOR    CRITICALITY    ANALYSIS 
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APPENDIX    B    CONTINUED 
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APPENDIX   B    CONTINUED 
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APPENDIX    B    CONTINUED 
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APPENDIX  B  CONTINUED 
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APPENDIX   B    CONTINUED 
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APPENDIX    B    CONTINUED 


r 


f<:^ 


:,  <J- 


3     •-< 
U     (1. 


l<3- 


118 


APPENDIX    C 
REPORTING    FORMATS    FOR    DATA   COLLECTION 


GROUND  MISHAP  REPORT 


I.    I*A5C.     BA1£    COCC    *    ROf^T     tt    ni*(. 


O0^H.     COMO    *     •«•(.     tuSMlTTtHO    ^  S*  m  t 


I.      MiSM*P  r  YPE 


O^CfV*  TIOMAL 


J.   OtvEXlT-v   CLASS 


MUHAP   C»TeOO"T 


DATE    O'    MUX* 


I  C  0*4  r  M  A  C    '  on  JMAAIMI 


; OM«  A  1    r  MO 


SMV  >PO"T/««CP 


COML     C  A  An<  r  A 


<AA        MONTM  OAV  0«-      O*     ■*&«>■ 


itC  C\.L  AMCOU* 


MISHAP    LOCATIOM 


«.    WCATMCn        QJ    MOT    4     »»CTOn 


On    •A>r 


ucicaist 


o  T  MC  n  (t  tpiMint 


UlSHAP   INVOLVeO 


'IPC/  C  "  *LO«iOM 


10.  LOCAL     TIMI 


LIOMT    CONDITION 


It.  ■vMO'fit  (WAa>  H«ptMn«d  and  'Ar; 


1.  *ensoN  «epo«Teo  as 


■.  AatioNCO  on«M.  saic  and  como 


€.  SC« 


COMPONENT r~|   MOT    APPLICABLC 


AFACTIVt     I  OT-IP    uf  MIL   fSl7»e(/l'> 


'OPCISN  MIL  (Spaellr) 


rOPCION 


NA»    r£<-<n(f) 


y  ou  TM/ »  Tu 


FM  w,PC  1 


•ne-exiSTiMC  phtsical/mCmtal  limitations      rj,  MONC 


1.  OF'iccns  Cni.  . 


A  LCOMOL 


CWOTIOMAL 


CYCSiaMT  PMY9ICAI 


OThc*  (Spmcllr) 


MOM-K  A  TC  O 


J,      Disability  Classi»'C»tiom      flD  '"Juwy      ^  iLLMSsr     □  non« 


PfPM    tot Au 


rat' AT/ A(L. 


«OPAOAY  1   i.O»T  rErxtr  n».( 


K,    INJUWY     rvPC    ft    LOCATION 


pnoTECTive  eouiPMCNT 


111  MCOuiPCO  auT  NOT  uses  iCnm  lltm  *W  tvihrnitr) 


N.      iNvocveo 


OIP«eTLY 


ii.O'PeeTLr 


JOS  TPAINING 


■  couipao 


AOCOUATl 


M 


OATC    COMVLCTCO 


■  a'KTY    TnO  (H»f*tilf  m0  mn^  $irm  ctmplmtum  4*im») 


O*  UMIA^C    ACT 


A.    ACTIVITY    AT    TlUC   O'  MltHA* 


HE 


9    •     I     YCAP 


1«.  VCHICLC'  AiPCWA'T  nt'OMTCO   NO. 


A.  PMV 


Pwv.aov  T   aciwo 


*. 


AU  TOMOSIU  S 


^•OTOACY  CL€ 


*o*T«o  ACT/iir 


O*    YP.       C<   MA  AC 


a.   CITA  TION*  iltuCO  (Spmcllr) 


M.    VCMICLC    AC  TIVITY/AOAO   tUPFACC 


I.      OPCPATION 


OM    POAO 


OP»   POAO 


J.    OAMACC     C09^ 


U«Ar    PPO^eXTY   OAMAOC 


(HAJCOM) 


e.  ecacpipc  oamacc 


C.  LACOP  eOCT 


p.    MATCPIAL  COCT 


«.    TOTAL    COAT 


TOTAL  mSMAP  COST 


O.     TOTAL    A»    LO't 


f  7rPA-     A««»«.   4PA««  •«««  11(1*/ 


.ff    COMOM/  »UMCTlOM  AW   M««   iXf^m  ji.    ai« 
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AIRCRAFT  FLIGHT  MISHAP  REPORT 

iTo  he  filled  out  for  onnitpat  aircraft  mvnlveii     Ippri/pnate  itetit  i^i/i'  snoutJ  ^e  'ilteU  out  ot\  secondary  aircraft  j 


MISHAP  CLASS 

a  A      D  " 

□  c  Q  oesT 


4     UNIT   CONTROt.  NO 


»     ACFT    ASSICNMCNT/STATUS 

cooc 


PILOT(S)  INVOLVED  (FLIGHT  CPEVVI 


OPERATOR  AT  CONTROLS 


A.  CAST    NAMC,   INITIALS 


■     COMPONSN1 


POSITION    IN   AIRCRAFT    AT   TIME   OF    MISHAP 


lO.   NATIONALITV 


^ROW 


T  S«AT  LEFT  SEAT 


REAR   SCAT]  RIGHr    SCAT 


JUMP  SCAT 


r.  MAJCOM.   NAP,  OIV.  wa.   so   ASSIGNCO 


O.  MAJCOM.    NAP.  OIV.  WC.  SO    ATTACMCO   POR    PLYING 


OTHER    PILOT 


A.    LAST  NAMC.    INITIALS 


a.  COMPONCN1 


POSITION   IN   AIRCRAFT  AT   Tl  \<  6  OF    MISHAP 


^RONT   SCAlj^         [left   SCAT    I  [    REAR   SEAT]  j 


RIGHT    SCAT 


JUMP  SCAT 


O      NATIONALITY 


P.   MA.;COM.   NAP.  OIV.  WC.   SO   ASSIGNCO 


G.  MAJCOM,  NAP.   OIV.  WO.  SO    ATTACMCO   POR    PLTING 


OTHER  PILOT 


A.   LAST   NAMC.   INITIALS 


•  .  COMPONENT 


POSITION   IN  AIRCRAFT    AT   TIME  OF   MISHAP 


[pwowtscat]       I  lcpt  seat] 


REAR  SCA 


n 


RIGHT   SCAT 


JUMP  SCAT 


O     NATION  ALIT  Y 


P.  MAJCOM.  NAP.  OIV.  wa.  SQ   ASSIGNCO 


O.  MAJCOM.   NAP.  OIV.  WO.  SO    ATTACMCO    POR    PLYING 


OTHER  PILOT 


A.  LAST  NAMC.   INITIALS 


■  .  COMPONENT 


POSITION  IN  AIRCRAFT  AT  TIME  OF  MISHAP 


WrONT  SCAtI  j     LCPT  scat!  I    RCAR  SCAtI  T 


RIGHT   SCAT 


JUMP  SCAT 


O.   NATIONALITY 


P.   MAJCOM.   NAP.  OIV.  WO.  SO  ASSIGNCO 


S.  MAJCOM.  MAP.  OIV.  WS.  SO    ATTACMCO  POR   PUYINa 


CLEARANCE 


1  !■-"      I  r 


HE 


rT  TO  rr 


AlWW  A  r% 


Hh 


O  CLCAR ANCC 


OUAATION  O^   FLIGHT 


I  I.  TYPC   OP  MISSION 


II     ALTITUOC/CLC  V  ATIO^ 


l«.  PMASC  OP  OPCRATION 


tS.  TYPC  OP  MISHAP 


f«.  MCTCOROLOCIC  AL  CONOITIONS 


□  VMC  □■IMULATCO  IMC  CDtRANSITION 

niMC  OON  TOP  QvPR    IN    IMC  CONDITIONS 


AIRFIELD  OATA  applicable   TO  TAKEOFF   ANO  LANDING  MISHAPS  OCCURRING  WITHIN   J  MlLtS  OF   AIRFIELD 


A     PICLO  CLCVATIOM  II  ml 


■     COMPOSITION  OP   RUNWAY 

□     ASPHALT        3     CONCRCTC         OOTMC  R^JprCI  ^S'/ 


il-rrti 


O     RUNWAY    MCAOING 


C.   DIST.\NCC  OP   TOUCHOOwr 
PROM  RUNWAY   It-rlll 


SURFACE  CONDITION 


n  ORY      [^WCT 


OTMCR  iSpect/\  I 


a.  LCNOTM  OP  OVCRRUM 


COMPOSITION  OP  OVCRRU»> 

iSprcifyl 


TYPC 


usco  locatio^ 

Qycs  Qno 


J'  CONOITIONS  APPECTINC  OCCURENCE  /I- "f  example.    t\  pe  of  utttnimerft  or  ttglitirxg  approach  used.  oOsrructtont    Oarrtrr    airspeed,  grvu 
\rnthi,  forerJ  latuJingi 


If  ««,.«■  r/iu#i  1,'iir  r'l''lf  are  inM<h  ,  ,1  II  h<tht  (.  re%%i  *>-p,'rt  lame  utl,iririarton  retjuirrj  o'l  ^Ji  nonal  thee  I  tor  rach 
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AIRCRAFT  MAINTENANCE   AND  MATERItL   REPORT 

,.     .I.C.-r     ,c,,..     ~.-.t. 

!•      "1SS1C\      jESK:-.      ANO     SE'IES     I«10SI 

3.                                                                                                               MiSTCiCat    OAT«                                                                                                                           1 

*l  BC9*FT 

LEFICICMPABT     :0'.'PON£')T     OR     *:CcS50PV                                                         1 

ii •    ro»ct    iCCf •'•ICE    3«r« 

■.0   )N 

TOT«L     fLISMT     -Ou»i 

»«•'     N,.UBC» 

•     0         »  E  «  €  0  <  N  C  E 

Ovt«M«ul.lNO    »cn  VI  '»(«•••  4  Loc) 

'  1  CljOE 

mOU«S     Since    Ov€«"«>,l 

SOE  < 

MOLUS   SIXCt   L«5T    S^xeOULEC    f<5>. 

•  OBK     J-.  1  T      :0C£ 

1 

o«rE  o»  HIT  iCHfc.i-co  iis»e:-ic"< 

•0»     •tOL'ES'EO 

1     -ES 

NC 

.ES 

1        NO 

TY»e   Of    !.«»'    5O<E3UL<0    IXS^fCTIOS 

•JO"     ^JS-I  "EO 

!-      1 

NO 

•ES 

1      .0 

0»Tt    HGNEO    »»tsr-<r    o•■;^. 

uoa    --"SC" 

1 

ndCN.      rBAS4FCB«E0     COOM 

Ml  •     -,  .«?;  a 

1 

Engine 
(Compt  «t »    •    Co/un«n     /or    t*eh    Enfint) 

iNjTJtLEO   »asi r ION 

1 

1 

ENGINE    MODEL     «N0     S5«i E  5 

1 

ENOINE     5E»I«1.     -.ux^E* 

1                      1 

T0T4I.      ENGINE      »OU«J 

NUM«C*     OF     utJO*     0VE>H<ULS 

i 

H»S     SINCE     l.»)T    M«JO«    OvtHMiui. 

1 

o«rt   or    i.«iT   ovE»N«uL 

0»fl>M«Ul.     »CT1VITr 

1 

0«Tt     HJT     IN1T«(.LE0 

XOU«>     SINCE     L»5T      INSTHtLtO 

1 

0»Tt  or   LAS'    SCHEOULEO    INSPECTION 

TT»C   or    LAS'    SCHEOULEO    INSrfCTION 

«UtL    (Trt'    »    Octmnt    tmt,i>t) 

Ton    UtauESTEO 

4.                                                                                                                   SOAP    SAMPLES 

ftn^inm,    CSO.    Gwtrbam   or    Art/    faitvf   of    whtrh   oceurrod   or    ««•    tumpoclm^) 

ITEM    AND    SERIAL    NUMBER 

NOUOl     SINCE 

TE 

C« 

AL 

cu 

SN 

MG 

Tl 

~ou«s    siNCf 

'E 

c» 

AC 

AL 

CI- 

^^ 

MG 

'. 

0/M 

OIL    CNANCt 

0/M 

OIL     tMANOE 

'•                              ,r 

DAMAGED    AIRCRAFT 
•  A    caa»/*(«    ilomaf     In/arMtiao    yindor     fob      "<■  "        *•*    Af    Form    fttb} 

f'» 

OAM«S(     TO    AlUCKArr 

1       1       OCJTHOTtO    0«    OAMASeO    ICYOMO    CCOHWICAL    M^AIK 

1       1       )U»«TA«ITIAL                      Q       MINO*      [~]     LtSJ     TMAH    IlINO*    0»    NONf 

UMWOURS    TO    AfrAlA 

COST    IClTlHATtl 

EIRE    DATA 
*•                                             ( Tm    k«    e»»ploto4    *h9n    firo   or    chomicai    omplotton    «eewre.    «•  f     r«aw/r/*4 
fr99    ground    imfmct.     Iltdi  cot  m:     f    •    ^rohohlo    or    K    -    gnowM.     in    a^voroo) 

A,     HalEAIEL     'AlLUAf     CALSINO     TMC     f  |  It  E 

•.                         ICNI'lON     SOu»CE 

c              -cwsusTi  a.E   -lATf  SI  AL                        1 

H.ICT«ICAL 
STSTtK 

'•o'uusioN 

SYSTEM 

ELECTtlCAl 
S»5TtM 

5'ATIC     ELEC- 
r»i  CI  TV/L 1  GOT. 
NING 

CA«CO 

-•OAAUj.  1 
'LUI  0 

NG 

rufL    STJTCH 

(LECD    AIH 
ST5TEM 

VNEUMATIC 
STJTEH 

OTMH  (Uotilri 

ELECTAlCAl     IN- 
SUL ATIOM 

LU»«ICAT 
OIL 

MTO«AUl IC 
JTJTtM 

OT»E»    (Sprcitr) 

'•O'ULSION 
STSTEM 

El'lOSI »ES 

O'NEA 

(•  J».e<  It) 

rutUKATIC 
ST»TEli 

UNDOVN 

•LEEO     Al* 

UN«NO**l 

'JEL 

UNANOHN 

»•                                                                                                                LOCATION    Of     INITIAL     FiBE                                                                                                                                     j 

KNO*N 

»«0»A»lE 

«NO«N 

'•0»«»lE 

KNO«N 

»«OtAM.E 

•ACSAGC     CO"»A»TMENT 

AfT     Of     TI»f»AlL 

w-EEL     »flL 

•out     (AT 

rO«»A«0     0'     t 1 AEWALL 

CAAr,o.>AiSENCE>  C0«»A«T1«T. 

COC«»i'    00    cof*    QxAOTta- 

•OC«ET    'OO 

0  '"(•   (  S»»ci  /rj 

fHOINE      SECTION 

T,„   .     ^,,t     -.     ...,, 

TN.NO.N              1      i                                                                                                               1 

1^                                                                                     MISCELLANEOUS    CmCwiCal    E«plOSiON    data                                                                                          | 

«NO«N          • 

•"»A«I.C 

INOVN 

•  •OUASIE 

INITIAL     IGNITION    OCCU«*EO     IN     AN     El'LOSIvr 
lAANNEtt     »«I0*     TO     GAOUNO     IMPACT. 

iN'ENSl'v      ar      tl»L0MON      (AS      <U»«ICIEN'      TO 
CA.JSE     0«     Ar»«IC  1  AHl.  1'      "ONTAItuTl      '0     IN- 

B  I'LO^ I  ON  ocri.»«ro  •"»•"•»  »»f'r>Af  '•0  IMPACT. 

T-IA     Mr.Nlfirisf     OAiA    (Xporitr) 

f  IH./^*!  ^N    "rfMABf  n     Sl.A^rOr'N'     Tn'-.A"'*.^      INPArr. 

•V»N-|»N      '>•      Wn'       4*A(l,IOl.f                                                                                                                                               1 
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lit.                                                           PSYCMOPHYSIOLOGICii.    ««0   ENY  i  ROKMEmTAL   F*CTC.-!; 

IHST^UCTIONS:      Coi»ol»t»    an     •llorcupanit    of     aircraft,                        PHASES     Of     «l  SMAP                              F4CT0B     IMPORTANCE 
•  II     iniurad   perioni.     and    all    prriona    pa«iibl|>    con-                        a    -       tcciOIair                                      0    ■       ot'iMUty.'r 
trlbulini     to     (h»    cauia    of     the    -"ifhap.        Suparvitory                         C    •        CSOPt                                                           CONTaiti^TlO 
faetora     atlributfd    to    partona    not     in     t  h«     aircraft                            L     •       l»NOl>.0                                           1    •        ?uS»fCTtO    r»CToa 
and    aoeh    faetora    aa    drii(n    or    waathar     ihould    ba     ra.                     $    •       luavivai   (■;>>cJ»rf»a              a    .       ■!ot<oiTioN    ••t5€>iT 
ported    onljr    for    t  ha    parten    in    primary    control     of     the                              »«rac»'«(a    ;an<«if>«a>                        jo  r    oio   not    con- 
aircraft.        raclort    contribulinf    to    iniury    during                            a    •       aiscui                                                       raiiuTt    to    >CC  ' - 
■  id>air    colliaiona.     craah    tandin(i,     ditchinft.     ate,                                                                                                   OInt   oa    tnju*' 
are    to    ba    centidarad    part    of     aurvival    phaaa.        Ui* 
cadaa    at     ritht     to     rho*   only    thoaa    farlort    pratani    or 
eontribulint    in    aach   phaaa. 

FACTORS 

A 

£ 

L 

S 

R 

fACTORS 

A 

E 

L 

s    ^=1 

I.     SOPtRVlSORV    FACTORS 

,.., 

., 

«  1  SUAL      ILI.U5I0IO                                                                         a  1  ] 

uNCONi; lOusNf )5                                                ti< 

1 

iNAOtOuATt    aaicriNG                                            lOi 

0 1 soai CMTAT 1  ON/ »f art  SO                                   til 

eaocacQ/Lto  OK  rti  gmt  acoxo  c»»»an.  i  tt    lOt 

xrrox 1  a                                                                          lit 

Pooa  c»c*  cooaoiNAT  ION                                   ii^i 

HTrtavtNT  1  1.  «T1  ON                                                                  t  I  7 

OTMC*    (  J»a«  i If)                                                                   11» 

DTjaaaiiu                                                                     tit 

.j  ... 

OaaON    MONOIlOt     rOltONiNG                                       tit 

i 

2.     POe-ruiGHT    f-*CTO»S 

, 

loatoou                                                                 t20 

INATTtNTION                                                                                          III 

j 

rAUlTY     rilCMT     H.»«l                                                                     JOl 

CMANNfLIZtO     aTTfMTlON                                                        tJt 

1 

fAuiTT    »»t- ri  1  GmT   Of    «iaca»rT                       lOJ 

0  1  iTatcr 1  ON                                                            iti 

rauLTT   ratP<a*rioH  or   acasONai.    coui'.    <0] 

•  atocCiiPaTiON  aiTMrtajONAi  raottiM^        tia 

1 

1 

Huaaico   oCPaaTuac                                                 ioa 

fiCIISIvC    HOTlvtriON    TO     JuCCdO                   <2> 

oiLATtO    ocPAaruac                                                 lOS 

OviacONt 1 otNCl                                                                   tit 

INAOCOUATt     afATHO     ANAt.>-SII                                       I0« 

LACA    or    jcir-coNr lOiNCC                                 tJT 

OTMta   CSpaaifr)                                                         m 

LACt     or     CONriOtNCt      IN     fOUIfMCNT                         t]t 

apaaCMCNSlON                                                                        IK 

3.     EXPtRIENCt/TPAININc;    FACTOPS 

L— 

FAMIC                                                                                                              tlO 

oTMca  ( Sftt 1  If)                                                III 

INAOtOUArt      TaAKtlTIOH                                                           10  1 

LIMITtO     TOTAI.     (irCaitNCI                                                  >0I 

LiMiTtD    aiciwr    CKPtaitxct                               lOJ 

raikuac    to  ui(    icccptco  aaoctouaci          loa 

T.    €NVI»»ONM£NT*L    FfkCTORS 

OTM(*    (SfCilf)                                                                         )«• 

ACCtUiatTi ON     roactt.      iN.riiC»T                      TOl 

4.    OCSIGN    FACTORS 

.,» 

•CCCltAATlON     roactl.      IMPACT                                 ?02 

oteoHpantioM                                              Toj 

ecSIOM   or    idjrauntNTj.    coxTaoLJ                  '0 i 

viaaATIOM                                                                                                TOA 

LOCATION     Of      INJTauMINrj.      COMTaOLS                  <0> 

SLAai                                                                               TOt 

fAiLUX   Of    iNirauutNTj,    coxraoLt              40i 

SHOIt.      rumt.      ITC.                                                                   TOt 

COCaPIT    LIOMTina                                                          '»« 

»tAT                                                                                                                  TOT 

■unvAv  LieMTiNa                                                 *o* 

COlO                                                                                               'Ot 

i.i«HTiN«  Of   OTMta   Aiae»«rT                           aoa 

alNO     ((.AtT                                                                                             TOt 

PtatOMAk.    touifMCNT    inrtartiCNCt                 'Ot 

VI 1 . acjTa. ■ at ATMia.    maii      OAatNtss        tio 

•oaasPACC    ii«comp>ti  ilc   >ith  hah                 ao* 

vi». at»T».. ieiN«.   aiNOOai    roceto.  tTC.'i' 

OTMta   f.'pac./rj                                                  4ta 

"H.  at  «Ta..DuJT.   iMoal.  tTc.  .    in    AcrT.  tij 

aCATMta.     OTMta     TUAH     VltiaiLITT     ttSTa.TI] 

OTMta  <  %ft  ifr)                                                 T»i 

MISIMTtapacTtO     C0MHMII1C4TI0KJ                             10  1 

OlSauPTtO     COIXUNI  CAT  ION!                                                 101 

«.    OTMCR    FACTORS    TO    IC    COftSIOERED 

LAneuASC   (Aaaita                                               >oi 

•out    iwrtartatNCt                                              JOa 

M»«|T    iMTtarta..    usto    aaoMS   conraot.       lo  ■ 

1      1      1 

OTMCa   f  S»»e  Hr)                                                         It* 

cONruliO"   or    coNTtoLJ.    OT»ta                      loi 

1 

MItatAO     INtTauHtMTI 1)                                                         101 

1 

«.    PSVCH0W<VSI0U0CIC*L    FACTORS 

Ml liNTtaPat Tie    latTauHtNr    ataoiNO           tot 

1 

Mitkio    •»    raoLTr    iNirauHtMT                          eoi 

fooe  poi  lOHiNS                                                AOi 

•  isuAi.    atira      it    tOuiP.    tTauCTuPtS         tot 

■aoria>i    iiCaNtsJ                                                        (Oi 

r«»«    ovtajAIyaaT ION                                                    10 7   | 

OTMta    acu'l    iiitu*                                            aoi 

INAOIOViA't      COOaOlN«TiON      oa      TIMING                 to  t    | 

OTMta    aafHilTiHS    o  i5C  alt 'OC  '  tc  t              toa 

MllJUOSlO      J»ttO     oa     OllTANCl                                    tot| 

1 

6t  T'MCMt  1  T  1  S                                                                                         (01 

5tt(CTto    •aoNG   couast    o'    •c.tion                t'O 

MANCOvt*                                                                toa 

(Ml.«»     IN     'aaiNO    "fCISlAPT     •CTiON                til 

JltlP     OtPaivatiOM.     raTiout                                   »0T 

x.oi^'iON    or    ri.4»i    oiJCiriiNt                    t'J 

j 

rafioiif.    0'»»a                                                           toa 

•  t«  1  ,;•  t  inNai.    1  aara                                                   a  i  1 

■aiiKO   <•(•!.  t                                                                <o« 

.««ovtaTf.r    nPta       jtir     iNOuCfO                    »'• 

1 

oauei    aancaiaco    »»    mioiC«i    O'ricta         «iO 

-  Naovc  a  T  f..  T    QPta       Mr  cnan  i  r  «L  L  t     inOuC     IM 

oauoi.    OTMta                                                                t" 

I  >.ia    1  ifr  1  'r  )                                                                m 

41.C0M01.                                                                                                 tU 

Muat    or    iNOivioo't. 

llAN 
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IV. 


PERSONAL   Dili 


ROLE    OF      fHIS     INOIVIOU*L     IN     THE     CAUSE    or     THIS     ACCIOCNT 


CONTH I tuT I NG 


^     ptoa .        I  I   » .  >oa$. 


ff    >   UHRNOWN 


C.  Burr    o«    «OLt    "T    T  mt   Of    tec  I OCNT 


BACKGROUND    DATA     (Comgl  »(  m     for    til    pilott     mnil    alhtrt    »>i»    pottibly    con«rttur«<<     l»    nnh^p.; 


iT- 


«.    0»TC     l.«5T      I  t  «»l 

INPC9     (D*r-X'-'fr    ) 


T  T  »  c    9  f    L  «ST    1. 1 «  y  e     r  «  «  tpN 


1       "tCNL I S' 


*  .   C»*OUAT  '   3N 


9 .    SI  C<     0* 

CONVl. 
LEICCnT 


•  • OCLIT    (H* . 


•    •   JNKNOVN 


0.   OATf    0»    LAST    »«CviOui 

rtiSMT  (D»r-it».-yr. ) 


H,     S0*TI(5     rLOVN      IM     LAST     4« 

HOuas 


I,    MOUMS     vOa«CO     >M     CAST     24 
mOu*S 


L.    MOU«>     SLt'T      IX 
LA5T     4i     m0U«S 


H.     HOUKS     CONT  I  •auOU] 

OUTy     >«10«     TO     MIS- 


m,    H.H5.     CO»<T  I  NUOuSLT 

AMAKC       *«lOff       TO 

Ml   SHIP 


»  .  T  mc  IV  C0C«'  I  T 
»»I0«  TO  '(.ISmT 
C»r«. .    Vin. ; 


9.   DATC    I.A$r    mviout 

rtr.   THi s  Moock 


OC'LOYEO     UKITJ 


J.  oATc   o£H.OTeo 


T  .    NO  .     0*r  5      IN     AltCA 


PHYSIOLOGICAL    AND    VEPTIGO    TRAINING  C^or    til    rmrwmml) 


rm   or   t**iniii«  iccoMrLisxco 


'LtCC     TXININ6    ACCaH»L>  SHCS 


COM^lCTtO 


MONTH  VfAft 


•  OLt   ' 
I  N 
Ml  SM«» 


ANTHBOPQMETWIC    DATA 


jrroCK-tNcc    lCnctm    (Intl<»t) 


A.    OATC    t'    (lltrH    ( DtT-HmntS-Yfmr) 


a.     SITTINS     MtiaHT     (Imlh^t) 


H.    L(a  LCnsTh  CrncA«>) 


(.  HCl SHT  ^ IncA*«> 


C.  TRUNK  hC(GmT  (tnehmm) 


r.    fUNCTIONAL  KdCH  r/nefl**) 


C.   ICIGMT    f<.»a.; 


I.    SMOULOf*    «IOTH     IIIOCLTOIOI 


S.    TOTAL    reA*5    or    roAMAL    [DUCATION 


GRADUATION    FROM   UNOERGRAOU ATE    FLIGHT    TRAINING 


7. 


AVIATION     SCHOOLS    ATTENDED    SINCE    GRAOUAT I  ON  r />ic<»</*    dtfml    tomflttlmn) 


FLYING  EXPEHIENCE 


A.    TOTAL    FLTiaa    xOUAS    <ll>clu4iltt    *'     I|M«. 
mth9r    mccrm4l t9d    lj««i 


•e>4«Nt     cnrf 


C.     TOTAL     TIMC     TMIJ     AlAOAfT 


t.     TOTAL     JIT     TIMt 


0.     TOTAL     (CATmCA      INSTAuHCMT     HOUA* 


rmsr   »ilOT    tHO 
mSTAuCTOA    »IL0T    N«». 


ALL  AiaCOAFT 


TMtl  AltCAAFT 


fOATICI  TMIJ 
II »C«A«T 


O.OAIOINAL  aCAONAuTI. 
CAL  aATINa  AND  OATt 


•  .  »»l»f N'  4t aONAUTI  . 
CAL  XT  ISO  AND  DATt 


OATf  or  L«?T  CxfC" 


1.  INlTAuMtNT 


'•0» 1 C I f NCT 


OUTT 


AVIATION    SERVICE    COPE    an-i    CL^isr,    tcTiviTY    CATCCORY     i  i  A/ 1  .     mj/i.     F.  TC  .  > 


CU»«f NT 


••t  V  I  0U» 


'•t  V  I  Ou  1 


•t| V  I  OL  » 


«••■(     0»      iNO'»"Ol«». 


i   ^ar    r«/«     in    «i«A«p    t I  I pm    >).     rA«     /•//avinf    corf««    *f/f     N»    u*#dl 


•  -  ^»    Import  mmf» 


7  ■  T,,i,imt   a 


"4    '1»  f  tn  I  t  »     t  »r  t  ' 
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LIFE  SCItNCES  REPORT  OF  AN  INDIVIDUAL  INVOLVED  IN  AN  AF  ACCIDENT/INCIDENT 
SECTION  A,  AIRCRAFT  ACCIDENT/INCIDENT 

(THIS  FORM  /S  AFH-CTf:U  BY   Tift    r'^H     ir)     \r^  Oh    I  1-J.  SrFrA.<;TPACEJ 


fLlOMT    04 TA 


■'IMC    »T    C»Bi  N    ACT  I  ruOE 


:lCuO    CONOl  r  I  0N5 


••u«0Ctc»5T 


1 . ove«c«iT 


1-   I  X    ClOoOS 


Ml hu  T t  S 


«-o  fHit    r  Sp»c  1  fr) 


*■  ■  s   itc   Of'  0'   CLOuos 


t.      IMdCNT     «Lfl'UO€      »'      flMC 
or      (HtHetNCY     (f»")     M»L 


Time    *T    amBi  Ent 
«LTi  TuDE 


hORi  20"* 


PLACE     IN    roOMATiON 


t-  0  'mC  tt    ^  5p*c  I  ^v> 


I-  osscu "to 


1-  51  XGL  C     «  I  •C»»»T 


?^OAT I  ON    or     CL  I  CmT 


T- 0TMt«    ( Sp«e 1 Ir) 


MEDICAL    INFOPMATlCN 


OEOBEE    Of     iNji.BY 


l-ui  If 

<  Ha 

LINO 


'•wi  SSi  N<J 


•  •  Ml  N  t  U*L 


1        01.  S     -0S»  I   f  "L  I 


].    o»Tj    IS    ai,»»Ti«s 


4.     0»0UN0C0- OuK«  r  I  ox    <Otyt; 


5.        JNCO^SC  '  C- S-OLPA"' "■ 


NJU'^lES      INCIjC'EO     during    Ml  S^'AP       fLf     §ltniitrd     '.o»»-c  I  •!  u.-»     •• -o     cocinj      'or     V«rur.     a  n<f 
L«€«rion    o/     Iniury    (Ltn*      t)     and    £<rtrn«i     C«ul«     '  L  i '^9      2'  Alto     i  nd  ■  c  a  f  #     « /id    c  odt     Locttion 

fhatt    ol    Uithap.     and    frabUm,    (L,n»    ]).        Sf    AFU     117-1    'sr     tprcilic     i  n,  i  r  jc  I  i  an  t     ) 


:ooE 


N*TUP(      AND     LOCATION 

IITONAL    CAUSC 

LOCATION.     PMlSC    0'    MitHAPS.     *N0    »*OtLCuS 


NtTuaC     ANO     LOCATION 

lITtPNAl.     CAUlC 

LOCATION,     •hoc     0'    MI1H*»J.      tNO    'AOtlCM] 


NtTuaC     ANO     LOCATION 

(|T(IIN<L     CAU5C 

LOCATION.      »M«SP    or     MllM«PJ. 


ANO     ••OILtUS 


NAru*C     ANO     LOCATION 

tart*NAL   CAUSC 

LOCATION.     'Hill    or    HI1MIP1.      >no    ••0«L(H> 


NATult     ANO     LOCATION 

(ITfUNAL     CAUSI 

LOCATION.      »»ASt     or     MIJMAPt. 


NO    ••OILCUS 


LAaOSATOHY    TESTS 


nSSUE    TESTED 


ME -^00   lSED 


LA9    TESTING 


CCOES  '  !.»•»-  •>'  •"» 


CA*(ON     MONOaiOC 


LACTIC     AC  10 


OTMt»   ( Sp*c I Ir) 


(.      X.«»Y     »C$LILTJ 


t.     01  SCAJCS^OCr  CCTS    XCSCNT    >T     tihC    0'    MlJ~<r 
01 ASNOII ) 


vE^CO    :-    DISCCVEPY 


»NNLI«L  ?  I  C« 

CALL 


AAI'.EOS    r/)i    tppl  ic  mb  { f) 


AUTOPSY    CONOUCTEO    9Y 


MATESliL      SLPVIT-fO      Tr     AflP 


r-riicNT  luPecON 


I  ■  *u  Tor  ?■»    •#  ro»  T 


3-  •  IC  Tli«f  $ 


c-  ei »iL I  "N 

»4TM0L0ei 5T 


J'AOZtN      TIJlLC 


A.rilCO     TI»JU» 


■I.     PCMtaii    o»    CONTINUATION    or    >(0>r 


'J.      MUMa*«     ACLIAtlLITY      •3JITI7S 

g-"    □ 

«<M(     or      I  SOI  VI OU«L 


1  TC      0«      Ml  5-«» 


LEAVE    RlA- 


•5S icsto    usi ' 


't      0'       HJlSSMCSl 


ft  I  ar  aar  r    •aos 
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/V.                                                                      TRAINING    S£L4I£0   TO    ^HlS    iCC  1  DEN  T/ 1  NC  i  OEN  T 

^  tfsc(  <"■  oihrr)  To^i>ii-,o              •,•«<■   OF   co'jRs-:   09   ojr             '               r»-!i    « ' "  i  V '.  t :              :            jp-i-:;or    ;;:ji3    i'^LiriSLL 

1 

1 

V.                                 PERSONAL  ANO    PROTECTIVE   EQU  1  PHENT  ^  5p-^. .'.    ..  ;    appi.cb;-    ,<f~.  <. /■   ^cu.p-.n. 

on     wpropriaO     (in»     •nd     indicatr     til      lypr,     if     cl  a  1  ti  i  n )     i-i.i     »^v    ofh^r     ffluipmmt      fhj.      in/l,jerctd    operttion) 

•.OMENtLiT'jUE      4N0 
''EM                                     MODEL    3C5IGNATION 

RE-                AVAIL-      1     „,,-           NEfOED     1         " '- 
3U1RE0    1        .8LE         !                                                '      ':*"0" 

L  35T 

FAILED 

PR09LEMS 

If  AO     l-ROTEC'l  ON               i                                                                                                                ]                           1                     1 

1 

Eye    »«otection              1                                                                  I'll 

Ein     POOTECTION                  1                                                                                                                                           1                     1 

1 

8«E«TMING     »I0                      i                                                                                                                                           1 

CLOTHING      *0  ON                        j                                                                                                                                                           i 

i 

GLOVES                                         j 

1 

.-00T«E«a 

I 

1 

eOOr     »EST«*INrs 

1 

1 

! 

COMMUN  t  C*T  r  ON  3 

1 

SE»r  »/0»  OTHEB  50UIP. 

1                           i 

ESCi'E                                      1 

1             ! 

TYPE     «««N  1  NG     1  SSU  EpI 

0  THE"    (  Speci  ly  ) 

VI. 

VEHICLE/EQUIPMENT                                                                                              | 

Mint                                                           MODEL 

NO.     OF     DOORS 

INSPECTION     CtBTlFICATE                                                        | 

PAOOED    OASH                        ^i^isH^LO 

RECESSFD    STEERING 
WHEEL 

DATE 

1 

Ml  L  1  T  ARY 

r. 

VI  L     . 

1 

1     l-YES     1        1    0-NO             1     l-YCS     1        1    0-NO    1        1    l-YES           j         1    0-NO 

MCCH»NIC«L    CONDITION    ffndicsH    by    (t)     Still 

^•etory    or    fuj    (/nR«r  j  •  ^Rc  f  o  rr  > 

•  •«»««E3 

1      a-  Tl  RES 

C-L 1 GHTS 

0-STOP     LIGHTS 

E-OI  HECTl  0N4L     =1  -.NAL  S 

[      F-REAR VIE*    MIRROR 

G-FXHAUST     SYSTEM 

H- STEERl NO    MEC- AN  1  SM 

J-H/SHIELD     «!•£•» 

1     Y-OT-ER    (  Speci  fy  )                                                                                                                                                                                                  | 

VII. 

CAUSE   OF    INJURY   nR    DEATH                                                                                                  | 

••STUUCK      STEE«INS     COLUMN 

9- •! ND^"I ELO 

C-  .  1  SOR 

0-01  SPL  ace:    '9  jEC 

fOOO»F«»ME 

F-  1  nto.joi  n3    09  j  EC 

G-FI  RE 

H-ORORNEO 

J-PEOeST^I AN     STRUCK 
9Y     VEHICLE 

R-ExROSURf 

l-exrlosi on 

M-STRLCK      SL9MERGE3 
OSJEC 

Y-OTHER                                                                                                                                                                                                                                                                                                      1 

VIII.                                         ACCIOEHT 

AREA    AND   CONDITIONS    (Spedr   •'/    ,ppiic»bi,   ,t,-..t>                                                             | 

TIMt  OF  OAYftoc**; 

1 -DAY   1 

2-NI  GMT        j                j       3-LIGHTING     | 

1  - 5*T I  $f ACTOflV 

0- .  NSATI  SF  ACTORT             1 

TYPE   OF 
SURFACE 

ROAO 
CONDITION 

TYPE   OF   ROAD 

ROAD 
CONFIGURATION 

WEATHER 

1-CONCRITE 

1  -  0  R  Y 

l-ONE     LANE 

1  -  STRAI  GHT 

l-CLE  AR 

2-MACAOAM 

:-ic£ 

J-T.0     .«NE 

J-CURVE 

Z-CLC'-OY 

3-lRI  C« 

]-»ET 

3-  THREE     LANE 

3-9AN« 

J-  RAI  N 

4'LOOSE    GRAVEL 

«-0NO« 

4-FOLR     OR     «ORE     LANES 

4-CuRvE     AND     BANR 

4-SNOR 

5-01  RT                                             I        !- SLUSH 

1-01    /I  DEO     'C«     L  A-i£ 

S-  IN  TER'jFC-l  TN 

5-SLEET                       1 

S  •  MU  0 

S-OI  VI  OEO    ■'<'Rf      -HAN 

9-  FOG 

T  RO     LANE 

T-H  AZE 

»-OTm£R 

». OTHER 

J. OTHER 

»-OTHtR 

»-OT~£R 

DCMtRKS 

IX. 

COMMENTS                                                                                                                      1 

T-15   SECTION    1  N'-v^:.  s  <"  :i  c»t .    >"•< 

on      INJU**      C«US«TION.           THt      «N«LT5IS 

riost    ««N0    n9*f"4»'iON5     1<    OE-l»En. 
50N3    fOSSlSLT     CONtm  BU  TINT,     '0    «I5h« 

3N«L      "ND     (-..I"--.-     ■.-■,          «      -     P         .I-.     - 

OF     ALL      FACTOR'      »  •      MJOICAL     0  '  '  1  C  E  »  ■  ,      •! 

IN'-LwOF     ■-•    N    (.-^-I'-U     «■   -  .    -.T     -.r     i-.- 

!• 

r      ^     -lor^-     .r-.aiN'-.     -JN      -"r      Ar'icfNr     an?' 

»«.(.90ROl   A  Tf      il  COVMFnC  AT  ICNS      R  A  •",  t  0     ON 
ITit-:     je     ORf.lO'.'i     "  ."     "'j      ■  ?  1  F  0  R     ALL     PER- 

I)  »r  r 

0'  '  .    .'  = 

■     t  ■      (OP  I  1. ....•.(  ) 

N  «vtl      0'      t  N.'  1  ^  f  0  (*L 

.  -.AN 
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yi. 


EGRESS  -  StRVIYAl.  GEHERAL  (Co-pUt,    for    sn    ,nd,. 


LOC*T ION     IN     Al BCt»f T 


•Jll. 


O^Of*    Of    «sr«»c    rix.     Jnrf.     •<£.; 


««yir.  •'OH'S'fNGINttt'S     C^^«'«"MtVI 


»«S5 tNSe«     5     COK 


f   S in  I '♦     d*c  k  ) 


OEASONISI     FOR    CSC4°E 

f  it  o  f  9      t  h  s  n      o  m^     '«r       »  o  o  f  r  ) 


^•SStNCEWS    rcv»*tTMIs»    f  Upff0f     (Jrckl 


I  Kf  t  J'LOS  I  01 


'•^JtHOf •■ S     CO«»««TMfNT     fto 


9-i.oss    Of    CON  r»oi. 


'•       '•."OUSO       ST»l;C. 


OTmC»    C0>"»»'><C'<T 


C-l lOINt      f*! LUKE 


j-L  »»NC  M    r  »  t  Lu^c 


tONGI  T'.  0  t«<*L     LOCATION 


I.     roiiwfttto    $t  C  T I  OH 


1 0-  »l  •  COLU  I  S  i  ON 


J.   CtHTtK  lfCf'C« 


SECTION   JNKNOWN 


CCvwjN  I  CA  r  I  onS    pbic=»    to    ESCAPE 


LATrail.     lOCATION 


•0I!T«CSS    ?1G"<4(.     ro«NSM|i 


I.     CCN'C 


J .    •  I  (M  r   1 1  s I 


ruAN^ui  r  TEO 


l£f T     Slot 


)  • f WE  BGCNC^ 


01  "EC  T ION    f  AC  I NG 


•  •cvr  •<;€ Nc* 


I.    ronaARD 


>.      SI  OKAHQ- 


♦  •  UN«NO»N 


t.      UNKNOWN 


uJt    or    SCAT 


Nt«9ES    OF    PBEVICU5 


NOT   IN  SIAT 


I  .   IN  SCAT 


SUNl/L I TTt» 


f jtc  riONj 


(of  4CCNC  *  • A»* - 
Cng'C  JUMTS 


mETMOD    of    escape    f»of»    f"*" 


■ ACCOM^t 1 SwCO    (Fr*9    ol     alfcrtft) 


2-4rTtM#Tto    (Did    "Of     cttmr    titer  tfr  } 


10  TERRAIN     OF     PARACHUTE      L  A^  0  I  NT.  /  C  0  A  SH      SITE 

(torr      fA«n      0«*      "•■•r      «pff/yj 


•-0»fN      %f A 


•-UNAHOWN,      JU5»eCTtO     IJtCTION 


8'V.AAttt      L««t 


0-OtflNITtL»     NO r     »TTtM»TtO 


T - Tm»OuOm      rafts 


!•  ACCOM'l.  I  SMID    (  frtm    »t    t  ircrmX  ) 


0-OtE»     •«TE».     OTmEU 


«t'STte'    sio»t 


l-«TTlMFTC8   ^Bii<    "•'    e/»»r    tittrtll) 


t-5"Al.l.0»     •ATC« 


'•UHINOVM      If     ATTCUPT     «AS     MAOI 


f-OltP     5N0» 


A-  1  N/Nl  AA     f  I  •€  SACt 


•-UN«NO»N.      SUSPCCTtO     •AllOUT 


G-THICA      ICt 


0-OCFlNITtLY     NOT     »TTtM»TtO 


A'lTANOAIIO     EUCACCNCT     SAOUNO     ESACSS 


I.hOO    saouno 


{  -UNKNOWN 


J-OIO     NOT     CJCAPt 


J-SOfT     GP00N3 


•0  The  A    (  Or  re  r  th9) 


tllT    UHAIJIJTCO    <0I*»'     (*•«    §ltii4»r4 


• -tUILDINS 


U'MOUNT Al NS 


L  *  *UN«Ar/0Vf A*VN 


«-CA*l)l  (D/A)SI1TC0     OUT 


I.  AIRCRAFT    ATTITUDE     AT     TIME    OF     ESCAPE 

(tllXrr     ie>     llithi     »r     mlitt     er»tt\.     dilchiKf,     »fe.) 


If  CSCAAt   ACCOMPl I JKtO 


f-CSCAPt.  kCTmOO  UNKNOWN 


O-NOJC     DOWN 


3. 


INTENT    FOR    ESCAPE 


[l-IWTIWT.  I  [      ?-U»INTENT. 


9-UNWNOWM 


I-AICmT    (an« 


0-ltfT      tANH 


EXIT   USED 


A-NOlf     DOWN     5»1N 


l-NOPMAL    e«IT    (llttlian    tifr    k/ewin|    ctnvtr) 


l-CMOCtnCr    Cii  r 


C-OICIL(.  ATING     SPIN 


9>N0*<iAL    HIT    (TItroMtfi    emnatr) 


O-AOLI.  INC 


E-  ruMil  ING 


f-OlSINTEGAAnON 


S. 


COCKPI T/CA9IN    CONDITION     AFTER     IMPACT 


0-nO    OAtiAGC    (Olt**r     f  Awn    cmnnpr    /ott.     tfc.) 


•HINOP    OAMAGI    <Or(iKilrlr    ><tbi  I  »bl») 


I  •  S  TWAI  G-T     AND     LEVEL 


1-ACAJ0NA«IT     INTtCT     fPr»»»»/r     A«»l(A»(»> 


J -UNKNOWN 


1-WAjOP    OAWACC    (  frohth  I  r    i^wf     hw**rw6JwJ 


A*0CSTWOVE0     (  0*  I  l/^l  t*  Ir     nor      A«Atra*/«J 


t*UNKMOWf« 


EJECTION    SEAT/PARACHUTE     TRAINING    (M » I     r>«uir«4     (ar     »aif«x|»rt     «Aw     h,d     no     apmprtunit,      lo     rtcmpt.) 


TTPt    OF     TAaiNllie 


LCCTUKS/ 

0(wanir*ATioNS 


TOTAL     M»«. 


OATI     Of     LAST     TNe 


ILC»»f    tLaNAI 


Uta     I ht      tmltom%n0    e orfw s     rw 
•  ftww     rmta      rrpt-^tng     plmyad 
IN     fA«a     m  t  t  f<  s  p  ■ 


UMARMtS    tJICTIOn 
MAT 


AMttO    SIAT 
«■     T9«f« 


raAiiaiN*   films 


PAAASAI L 

TRAimiaa 


juaip   fCMOOL 


otmi*  I J»»e I fr> 

NAHl      Of       I  NOl  V  I  OUAL 


S-MO  IMPORTANCE 

i-r>«iiiiii«   oEfiNircir   ■(tPtO 

l-t*tlNi««     POSSISLT     NtlWtft 

l-LAC*     OF      rwaiNlNC     OtflNlTJLT 
A     (ACTOR 

A-LACa      OF      TWAINING     POISltlT 
>     fACTO* 

♦  -UNaNOwi* 
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VII. 


EJECTION    OR    BAILOUT    (Cempltt*     for    »ll     mfliiht     fttmpet     and    t  itrl  ionm ) 


I.  TIME    FROM   ONSET    iNTIL    ESCAPE    ATTg-iPT    KtS    ISlTiATEQ 


C      POSITION     OF     EJECTION    SEAT     AT     TIME     OF     EJECTION 


w  (  NU  T( S 


StCO'<Oi 


J-'ULL      OOWI 


DELAY     IN     INITIATING    ESCAPE     OUE     TQ 


3-  I  NTt  "Xf  01  »Tr      »05  I  T  1  0" 


♦  •uH«/«.oT    •r»t.ic»»i.e 


TO    Ovt»COMt 
PKOtLCU 


4.    Gil  IN  I  HG 

>t.  ri  ruoc 


I.  o<-«:« 


I       tvO  I  Dl  itC 
•OPlJL»TtO 
*«t  A 


>•     lOSInG 
ALTl  ruoi 


J   .     IJ"<«N0" 


3         «»0l OING 
UNJU  i   TXLC 
Tt  HI* I N 


METHOD     OF      SEPARATING    MAN      FOCM     SEAT 


*       I.05ING 
41 asrcco 


0- 0 10     NOT 


J-'USxtO 

5€Lf      »•»» 


»• 5»0N  r«Ncou5 

Tu«<»l.  ING 


TERRAIN    CLEARANCE    AT    Time    OF 


9  -UNRSOWN 


TTFaTTTTTTTT" 


p«i)*Chutc    op  cn  I  ng     a  I  ns'CCO 


TYPE     OF     SEAT     SEPARATOR 


!■  •«.  AOOCA 


iauli 


4.       PROTECTI VE    "ELMET 


<£LMET    VISOR    LOxERED 


)- l>  •AACMI.i  Tt 


'■ siusai wG 


ASTtNCD 


ME''MOOS    OF    DEPLOYING    pabachuTE 


o-NON    nt'i-OvEO 


I  -  AU  TQMA  TIC        T  Ilieil 


tcroKt  (hCDG. 


2- AXEHOI 0 


3-«Ai.i.  I  STI  C  Ot  viCt 


OUAINC  CGACSS 


A*   ZP  AG      I.  ANVAAO 


5-iTAT IC       L INC 


OUPIMG     CMUTt 

LAwoiwq 


i 'MANUAL  L  V 


CMIM     STUAF     FASTtNCO 
SNUGLV 


NAPt     5THAP     FAtKNCO 

SNUGLY 


PARACHUTE  OPENING  SMOCK 


0-NO       «-U>« 


O-xf  Gl.  '  Gl  itf 


'  -MOOt "ATt 


ZERO    LANYARD 


t  -UNA  NOWN 


WM(N     CONNCCTCO 


0-AVAI LAICC/NOT 
CONNtCTtO 


15.       PARACHUTE 
CSC  I LLATIONS 


l-PRIO*    TO    CMOCCNCr 


A.      OUKINC    OCSCtNT 


0-NtG- 

L  i  Gl ILC 


1  •  MO  0  ■ 
t  »AT[ 


t-PI«IO*     TO     €5CAPt 
OURINO    IMtRCtNCT 


I-timC   unknown 


t.     DURING    LANDING 


PARACHUTE     DAMAGE    (Ci^*     nu«k*r> 


■  •NA/NOT     AVAILABLE 


SevtACD     JnHOUO    LINES 


SURVI  VAL     f  AC  TOP 


uissus  'uri; 


roPN    PANELS.     MAJOR 


TO»N     PANELS.      MINOA 


0-NOT     A     FACTOR      TN 
SURVI VAL 


'•'ACTOR     IN     SURVIVAL 


(•NOT     A     FACTOR     IN 
NONSuRV I VAL 


1-FACTOR     IN     NONSURVIVAL 


CAUSE     OF     PARACHUTE     DAMAGE 


•OPENING     SmOCa 


J-EjECTlON     SEAT 


AUTOMATIC  LAP  BELT  RELEASE 


3-TOULEO     ON     AiACAAFT 


••OThEB    (D»Acrih#) 
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USAF  MISHAP  REPORT 
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APPENDIX  D 
SAMPLE  FORMAT  OF  SYSTEM  SAFETY  HAZARD  ANALYSIS 
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APPENDIX  E 
SAMPLE  TREND  CHART 
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